What Is Clipboard Hijacking and How Do You Stop It?

Clipboard hijacking is when malware, often called a clipper, watches your clipboard and either steals what you copy or quietly replaces it. The best-known trick is swapping a copied cryptocurrency wallet address for the attacker's, so the payment you paste and send goes to them. Clippers also grab copied passwords, seed phrases and private keys.

To stop it, keep the malware off your PC in the first place: don't run cracked or unofficial software or unknown shortcuts, keep Microsoft Defender or your security software on, and check the address after you paste it, before you send money. Turning off clipboard history doesn't stop a clipper, and a clipboard manager can't detect one.

How a clipper works

1. Malware gets onto the PC, usually through a fake or cracked download, a malicious shortcut, or a bogus "helper" tool.
2. It sets itself to start with Windows.
3. It checks the clipboard repeatedly for text that looks like a wallet address, seed phrase or private key.
4. When it finds an address, it swaps in an attacker-controlled one that looks similar at a glance.
5. You paste, the address looks roughly right, and you confirm the payment.
6. It may also send stolen clipboard text, and sometimes screenshots, to the attacker.

A malicious browser extension that has clipboard permissions can do the same inside the browser. Install extensions only from developers you trust, and remove ones you don't use.

Recent examples

Security researchers published two detailed clipper write-ups in 2026:

• Microsoft Defender research (June 2026) described a clipper spread through malicious .lnk shortcut files on USB drives, active since February 2026. It hides the drive's real documents behind look-alike shortcuts, checks the clipboard roughly every 500 milliseconds for seed phrases and private keys, replaces copied Bitcoin, Tron and Monero addresses, takes screenshots, and communicates over Tor. Defender detects it as Trojan:Win32/CryptoBandits.A.
• Check Point Research (2026) described a clipper written in Rust for Windows and macOS. It was promoted with inflated GitHub stars and SourceForge download counts and YouTube tutorials with an AI-generated narrator, and the Windows version carried more than 15,500 attacker wallet addresses to swap in.

Both rely on the user running something they shouldn't, not on a flaw in Windows clipboard history.

Clipboard hijacker vs clipboard manager

Both read the clipboard. That's where the similarity ends.

A legitimate manager becomes a risk only if it keeps secrets for a long time or syncs them somewhere you didn't expect. How to audit whether a clipboard app talks to the network shows how to check one.

Does clipboard history make hijacking worse?

Clipboard history doesn't cause hijacking, and turning it off doesn't stop a clipper, which works on the current clipboard. What history adds is residue: a password or seed phrase you copied an hour ago may still be stored after you've copied other things. Windows also gives apps a documented API for reading the history list (Clipboard.GetHistoryItemsAsync), so don't assume malware can only see your latest copy.

The exclusion markers that password managers add to their copies keep them out of Win+V and well-behaved clipboard managers. They're instructions to cooperative software, not protection against malware. Can other apps read everything you copy? and is Windows clipboard history safe? go further.

How to protect yourself

1. Install software only from official sources. Use the developer's own site or GitHub releases, the Microsoft Store, or a package manager such as winget. Skip cracks, "free" paid tools and trading bots. GitHub stars and download counts can be faked, as the Check Point case showed. Microsoft Store clipboard apps vs GitHub releases covers picking a source.
2. Don't open unexpected shortcuts. Be wary of .lnk files on USB drives or in downloaded ZIPs, especially ones named like documents. Microsoft's mitigations include turning off AutoPlay for removable media and, on managed PCs, blocking shortcuts from running off removable drives.
3. Keep Microsoft Defender or your security software on and updated, and keep Windows updated. Windows 10 reached end of support on October 14, 2025, so move to a supported version.
4. Check the pasted address, not the copied one. After pasting, compare several characters at the start, middle and end of the address in the destination field. Attackers pick look-alike addresses so that checking only the first few characters fails.
5. Use saved addresses and device screens. Prefer your wallet's address book for regular payees, read the address on a hardware wallet's screen before confirming, and send a small test amount first for large transfers.
6. Don't copy passwords or seed phrases. Use your password manager's autofill. Never copy a seed phrase at all.
7. Keep sensitive copies out of history. Delete them from Win+V, keep cloud sync off, and set your clipboard manager to skip password-manager copies. How to stop clipboard managers from saving secrets shows how.

How to check whether your clipboard is being changed

1. Find a sample address for the cryptocurrency you use in that project's own documentation, or create a new receive address in a reputable wallet. Don't use an address with funds.
2. Copy it.
3. Paste it into Notepad right away.
4. Compare the pasted text with the original, character by character.

If the paste differs, something on the PC changed it. Close any clipboard tools and repeat. If it still changes, treat the PC as infected and follow the steps below.

If you think your PC is infected

1. Stop making payments or logging in from that PC, and disconnect it from the network.
2. From a different, clean device, move funds out of any wallet that may be exposed, to an address you verify on that clean device or a hardware wallet.
3. Change important passwords from the clean device.
4. Run a full scan with Microsoft Defender or your security software. Because clippers can also install other code, reinstalling Windows from clean media is the safest fix.
5. On a work PC, contact IT straight away and don't try to clean it yourself.

Clearing Win+V or uninstalling a clipboard manager doesn't remove a clipper that's already running.

FAQ

Can a clipboard manager protect me from clipboard hijacking?

No. A clipboard manager is just another program reading the clipboard. It can't stop malware from reading or changing the clipboard, though its history can show you afterwards that a pasted value differed from what you copied.

Does turning off clipboard history stop a clipper?

No. Clippers work on the current clipboard, which exists whether history is on or off. Turning history off only reduces how much older copied text is left on the PC.

How do I know if a clipboard hijacker swapped my address?

Compare the address in the destination field with the one you meant to use, from your address book or the recipient's original message. If they differ and you didn't edit it, assume the PC is compromised.

Related reading

• Can Other Apps Read Everything You Copy?
• Is Windows Clipboard History Safe?
• How to Stop Clipboard Managers From Saving Secrets
• How to Audit Whether a Clipboard App Talks to the Network

Sources

• Crypto clipper uses Tor and worm-like propagation (Microsoft Security Blog) — infection via .lnk files, clipboard checks, address swapping, Tor, detection name and mitigations.
• Fake reputation fueling a crypto clipboard hijacker (Check Point Research) — Rust clipper, fake GitHub and SourceForge reputation, embedded address list.
• Clipboard class (Microsoft Learn) — the documented API for reading clipboard history.
• Clipboard Formats (Microsoft Learn) — exclusion formats for history and sync.
• Windows 10 end of support (Microsoft) — October 14, 2025.

Copy. Stack. Drop.

Transform your clipboard into an interactive edge shelf. Stack, pin, and drag assets into any app with zero friction.

Download for Windows Get from Microsoft Store

How to Install Guide · First 10 Minutes Guide · Drag & Drop Guide · Edge Drop vs Win+V · Support