Clipboard theft is the collection of data a user copies to the clipboard, such as text, files, images, or objects. In cyber security, it matters because the clipboard often carries high-value secrets for only a few seconds: passwords pasted from a manager, API tokens, cryptocurrency addresses, remote access commands, or internal paths and code snippets.
Attackers may read the clipboard by polling system APIs, watching clipboard-change events, or using malware that runs in the background after compromise. This is useful in post-exploitation because copied secrets can bypass file-based detection and may never be written to disk. Defenders reduce the risk by limiting what gets copied, preferring autofill over manual paste, using EDR or script monitoring for suspicious clipboard access, and protecting endpoints where admin work or credential handling is common.