A clipboard clipper is malware that monitors what a user copies and silently replaces the copied text with attacker-controlled content. The most common target is a cryptocurrency address: a victim copies a wallet string, pastes it, and unknowingly sends funds to the attacker instead. Some clippers also swap payment details, recovery phrases, or other sensitive text.
This malware matters because it turns an ordinary user action into fraud without needing to break encryption or exploit a browser. It often appears alongside phishing, fake installers, or other malware families that first gain access to the endpoint. Defenders look for unusual clipboard access, suspicious process activity, and address mismatches before confirming transfers. Users can reduce risk by checking pasted values character by character, using trusted wallet software, and treating copy-paste of financial data as a security-sensitive step.