Adversaries may collect data stored in the clipboard from users copying information within or between applications. 

For example, on Windows adversaries can access clipboard data by using <code>clip.exe</code> or <code>Get-Clipboard</code>.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs)

macOS and Linux also have commands, such as <code>pbpaste</code>, to grab clipboard contents.(Citation: Operating with EmPyre)
Clipboard Data
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1115  external_id: T1115     source_name: CISA_AA21_200B  description: CISA. (2021, August 20). Alert (AA21-200B) Chinese State-Sponsored Cyber Operations: Observed TTPs. Retrieved June 21, 2022.  url: https://www.cisa.gov/uscert/ncas/alerts/aa21-200b     source_name: mining_ruby_reversinglabs  description: Maljic, T. (2020, April 16). Mining for malicious Ruby gems. Retrieved October 15, 2022.  url: https://blog.reversinglabs.com/blog/mining-for-malicious-ruby-gems     source_name: clip_win_server  description: Microsoft, JasonGerend, et al. (2023, February 3). clip. Retrieved June 21, 2022.  url: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip     source_name: MSDN Clipboard  description: Microsoft. (n.d.). About the Clipboard. Retrieved March 29, 2016.  url: https://msdn.microsoft.com/en-us/library/ms649012     source_name: Operating with EmPyre  description: rvrsh3ll. (2016, May 18). Operating with EmPyre. Retrieved July 12, 2017.  url: https://medium.com/rvrsh3ll/operating-with-empyre-ea764eda3363     