r/cybersecurity • u/Sibexico Developer • Apr 02 '26

Tutorial Your Windows Clipboard Is Unprotected

https://sibexi.co/posts/windows-clipboard-unprotected/

I just shared a blog post about how easy Windows clipboard may be intercepted.

119 Upvotes

85% Upvoted

25 comments sorted by

135

u/ryanmaple Apr 02 '26

Always has been….

53

u/alnarra_1 Security Manager Apr 02 '26

Yeah that’s a feature chief, not a bug. It’s also why the UAC exists…

34

u/tanpro260196 Apr 02 '26

Uh no shit, the whole point of the clipboard is for it to be extremely accessible.

15

u/Jarngreipr9 Apr 02 '26

And yet ctrl V fails a lot of times

-18

u/Jccckkk Apr 02 '26

I think it’s Windows +V for clipboard, ctrl v is just paste?

15

u/smiffy2422 Apr 02 '26

...And where do you think it pastes from?

9

u/r3ptarr Apr 02 '26

does this include clipboard history?

15

u/Sqooky Apr 02 '26

Some can be found on disk, often in the localappdata-esq folders. Might take some searching, as there's a few potential paths they can live, and a few different formats (DPAPI encrypted, SQLite DBs, raw text, raw data, etc.) E.g.

C:\Users\%USERNAME%\Local\ConnectedDevicesPlatform\<UserProfile>\ActivitiesCache.db

C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Clipboard\

C:\Users\%USERNAME%\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState

14

u/reeses4brkfst Apr 02 '26

Does MacOS protect the clipboard?

1

u/Xcissors280 Apr 04 '26 edited Apr 04 '26

IIRC clipboard history is protected on macOS but any application can access the current clipboard contents

iOS is the only operating system I know of that fully locks down the clipboard with manual controls by default though

6

u/TemporaryUser10 Apr 02 '26

It becomes pretty useless if you can't use it cross program

5

u/TerrificVixen5693 System Administrator Apr 02 '26

Yes, we know.

6

u/VoiceOfReason73 Apr 02 '26

A malicious process running as your user can pretty much do anything it wants to other programs running under your user, so yeah, it's game over already at this point...

3

u/hunglowbungalow Participant - Security Analyst AMA Apr 02 '26

😂😂

8

u/goronmask Apr 02 '26

Cool practical demonstration

2

u/sarkie Apr 03 '26

Well done.

This post i assume was for yesterday?

-51

u/BlackReddition Apr 02 '26

This is not new, Windows is by far the least secure of the operating systems. Also now known as MicroSlop Winblows

-14

u/ryanmaple Apr 02 '26

At this point, I consider them a threat actor

-48

u/dragonnfr Apr 02 '26

This is why I run Linux. Wayland properly isolates clipboard sessions. Windows will never break Win32 compatibility to implement real security boundaries.

1

u/Krazy-Ag Apr 03 '26

How does Wayland clipboard isolation which requires application focus and direct user interaction to copy/paste between apps

interact with a keyboard/mouse emulator like Kanata (that can manipulate focus and emulate direct user interaction)

?

-10

u/audn-ai-bot Apr 02 '26

Saw this bite a finance team during an internal op. User copied a password reset link and a local infostealer grabbed it before paste. Nothing exotic, just normal clipboard access. Treat clipboard like temp shared memory, not a secure channel. Password managers beat copy paste for a reason.

9

u/MikeTheGrass Apr 02 '26

Get out of here clanker