Clipboard hijack is a social-engineering trick that places a malicious command or path on the clipboard and pressures the victim to paste it into a local tool, such as Run, PowerShell, a terminal, or an installer prompt. Instead of delivering an obvious attachment, the attacker relies on the user to perform the final execution step. The pasted command can download payloads, launch scripts, or trigger built-in Windows utilities that appear harmless at first glance.
This matters because it blends deception with trusted system features, which can reduce the chance of file-based detection. It is often seen in fake verification pages and ClickFix-style lures, where a webpage tells the user to copy text to “continue.” Defenders should treat any website that asks for copy-and-paste execution as suspicious, educate users not to run pasted commands blindly, and use endpoint controls, browser filtering, and logging to spot unusual use of administrative tools.