| name | clipboard-hijacking-analysis |
| description | Analyze clipboard hijacking (pastejacking) attacks, ClickFix campaigns, and IUAM-style verification page lures. Use this skill whenever investigating phishing campaigns that use clipboard manipulation, fake CAPTCHA pages, or social engineering to execute commands via Win+R/Terminal paste. Also use for threat hunting clipboard-based attacks, analyzing pastejacking payloads, or building detection rules for clipboard-to-console attack chains. |
Clipboard Hijacking (Pastejacking) Analysis
A skill for analyzing clipboard hijacking attacks, understanding attack chains, and building defensive controls.
When to Use This Skill
Use this skill when:
- Investigating phishing campaigns that don't use attachments or downloads
- Analyzing fake CAPTCHA/IUAM verification pages that coerce clipboard paste
- Threat hunting for ClickFix, ClearFake, or pastejacking attack patterns
- Building detection rules for clipboard-to-console attack chains
- Understanding how attackers abuse the Clipboard API for command execution
- Reviewing suspicious PowerShell/CMD/Terminal executions after browser activity
Attack Overview
Clipboard hijacking (pastejacking) exploits the user habit of copying and pasting commands without inspection. Attackers programmatically place malicious text in the clipboard, then socially engineer victims to paste it into a console (Win+R, Terminal, PowerShell).
Key advantage: No file download, no attachment opened — bypasses email/web security controls.
Common Attack Patterns
1. ClickFix / ClearFake Flow
1. User visits typosquatted/compromised site
2. JavaScript silently writes Base64 PowerShell to clipboard
3. HTML instructs: "Press Win+R, paste, hit Enter to fix"
4. PowerShell executes → downloads archive → DLL sideloading → RAT
Typical payload structure:
powershell -nop -w hidden -enc <BASE64-PS1>
