Clipboard abuse is a technique where attacker-controlled text is placed on a user’s clipboard and then relied on as the delivery step for a malicious action. Instead of convincing the victim to type a command, the attacker tricks them into copying and pasting content that may launch scripts, open remote connections, or download payloads. The clipboard becomes a bridge from a web page or message into local execution on the endpoint.
This matters because users often trust pasted text more than visible links or attachments, especially when a fake verification page or help prompt tells them to run a command in PowerShell, Terminal, or a shell. Defenders should treat any site that instructs users to paste commands as high risk, restrict script execution where possible, and train users to inspect clipboard contents before running them.