type: attack-pattern
spec_version: 2.1
id: attack-pattern--e399430e-30b7-48c5-b70a-f44dc8c175cb
created: 2019-07-26T14:15:31.451Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1510
external_id: T1510
source_name: Android 10 Privacy Changes
description: Android Developers. (n.d.). Privacy changes in Android 10. Retrieved September 11, 2019.
url: https://developer.android.com/about/versions/10/privacy/changes#clipboard-data
source_name: Dr.Webb Clipboard Modification origin August 2018
description: Dr.Webb. (2018, August 8). Android.Clipper.1.origin. Retrieved July 26, 2019.
url: https://vms.drweb.com/virus/?i=17517750
source_name: Dr.Webb Clipboard Modification origin2 August 2018
description: Dr.Webb. (2018, August 8). Android.Clipper.2.origin. Retrieved July 26, 2019.
url: https://vms.drweb.com/virus/?i=17517761
source_name: ESET Clipboard Modification February 2019
description: ESET. (2019, February 11). First clipper malware discovered on Google Play.. Retrieved July 26, 2019.
url: https://www.eset.com/uk/about/newsroom/press-releases/first-clipper-malware-discovered-on-google-play-1/
source_name: Welivesecurity Clipboard Modification February 2019
description: Lukáš Štefanko. (2019, February 8). First clipper malware discovered on Google Play. Retrieved July 26, 2019.
url: https://www.welivesecurity.com/2019/02/08/first-clipper-malware-google-play/
source_name: Syracuse Clipboard Modification 2014
description: Zhang, X; Du, W. (2014, January). Attacks on Android Clipboard. Retrieved July 26, 2019.
url: http://www.cis.syr.edu/~wedu/Research/paper/clipboard_attack_dimva2014.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:31.403Z
name: Clipboard Modification
description: Adversaries may abuse clipboard functionality to intercept and replace information in the Android device clipboard.(Citation: ESET Clipboard Modification February 2019)(Citation: Welivesecurity Clipboard Modification February 2019)(Citation: Syracuse Clipboard Modification 2014) Malicious applications may monitor the clipboard activity through the ClipboardManager.OnPrimaryClipChangedListener interface on Android to determine when the clipboard contents have changed.(Citation: Dr.Webb Clipboard Modification origin2 August 2018)(Citation: Dr.Webb Clipboard Modification origin August 2018) Listening to clipboard activity, reading the clipboard contents, and modifying the clipboard contents requires no explicit application permissions and can be performed by applications running in the background, however, this behavior has changed with the release of Android 10.(Citation: Android 10 Privacy Changes)

Adversaries may use [Clipboard Modification](https://attack.mitre.org/techniques/T1510) to replace text prior to being pasted, for example, replacing a copied Bitcoin wallet address with a wallet address that is under adversarial control.

[Clipboard Modification](https://attack.mitre.org/techniques/T1510) had been seen within the Android/Clipper.C trojan. This sample had been detected by ESET in an application distributed through the Google Play Store targeting cryptocurrency wallet numbers.(Citation: ESET Clipboard Modification February 2019)
kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: impact
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
x_mitre_version: 1.0
x_mitre_tactic_type: Post-Adversary Device Access