Haxoris Wiki

Clipboard Harvesting

How Clipboard Harvesting works

Reading clipboard contents without user expectation can expose passwords, OTPs, or sensitive text copied from other apps. Background harvesting or sending clipboard data to analytics violates privacy principles.

Clipboard Harvesting in practice

Detect Clipboard Access (Android)

rg -n "ClipboardManager|getPrimaryClip|setPrimaryClip" src out

Hook Clipboard Reads

frida -U -f com.example.app -l - --no-pause <<'JS'
Java.perform(function () {
  var CM = Java.use('android.content.ClipboardManager');
  CM.getPrimaryClip.implementation = function () {
    console.log('Clipboard read by app');
    return this.getPrimaryClip.apply(this, arguments);
  };
});
JS

How to fix and prevent Clipboard Harvesting

  1. Minimise access
    • Only read clipboard when explicitly triggered by the user; avoid background reads.
  2. Never log or transmit
    • Treat clipboard as sensitive; do not send to analytics or logs.
  3. Platform guidance
    • Respect OS privacy warnings; prompt users and explain usage when necessary.

Last updated

References