Clipboard Hijack Detector

WHAT IT DOES

Clipboard Hijack Detector is a DeFi security tool that watches the page for clipboard read/write events via the Clipboard API, detecting potential clipboard hijacking attempts where malicious scripts read or modify clipboard content containing Ethereum addresses. It intercepts clipboard read and write operations, monitors copy and paste events, detects when clipboard content containing Ethereum addresses is accessed, logs all clipboard access attempts with timestamps and source information, and displays an alert overlay (suspicious/malicious) when unauthorized clipboard access is detected, showing the affected address and the source of the access attempt.

WHERE IT RUNS

This tool operates as a panel within the BotGentz browser extension, available for Chrome, Firefox, Edge, and Brave. It works on any webpage where users may interact with clipboard content, such as DEX interfaces, wallet applications, transfer forms, and DeFi dashboard sites.

HOW TO USE

Navigate to any page where you interact with the clipboard. Open the BotGentz extension and select Clipboard Hijack Detector from the tool menu. The panel will appear on the side of your browser. The tool automatically starts monitoring clipboard access as soon as the page loads. When clipboard access is detected, it will appear in the log panel with the access type (read/write), the affected address, the source of the access, and a timestamp. If suspicious or malicious access is detected, a visible alert overlay will appear on the page. You can configure monitoring mode, add trusted domains, choose alert style, and view statistics in the panel. Use the "Test Read" and "Test Write" buttons to verify the tool is working correctly.

TECHNICAL SECTION — CLIPBOARD API INTERCEPTION PIPELINE

This tool uses a multi-stage interception pipeline to detect clipboard hijacking. First, it intercepts the navigator.clipboard.readText() and navigator.clipboard.writeText() methods by replacing them with wrapped functions that call the original methods while logging the operation. Second, it monitors copy and paste events using document.addEventListener('copy') and document.addEventListener('paste'), extracting any Ethereum address patterns (0x + 40 hex chars) from clipboard content. Third, it analyzes the stack trace of intercepted calls using Error().stack to identify the source of clipboard access, extracting the calling function name and file location. Fourth, it distinguishes between read and write operations, flagging write operations containing addresses as particularly suspicious. Fifth, it compares the current domain against a configurable trusted domains list to determine if the access is from a legitimate source. Sixth, it logs all access attempts with timestamps, addresses, sources, and action types in a local log. Seventh, it triggers visual alerts using a dynamic overlay system with configurable styles (toast, badge, or modal) when suspicious access is detected, providing immediate feedback to the user about potential clipboard hijacking attempts.

THE PANEL

The side panel is designed for seamless integration into your browsing workflow. You can drag it to either side of the window, and it remembers your preferred position per website. It supports snap-to-edge behavior and can be collapsed to a small tab for minimal distraction. The panel is resizable horizontally and vertically, with a minimum width of 280px and maximum of 600px. Pressing the Escape key closes the panel. All settings are saved locally.

PLEASE NOTE

This tool requires the free BotGentz extension. It works with EVM-compatible chains (Ethereum, Polygon, Arbitrum, Optimism, etc.) when the wallet connection is used for enhanced verification. Cannot intercept clipboard access that bypasses the Clipboard API (e.g., using native DOM events). Relies on method interception which may have performance overhead. Some browser extensions may prevent interception. Cannot determine the intent behind clipboard access (legitimate vs malicious). Requires the page to use the Clipboard API for detection. Websites change their page formats frequently, and extraction scripts may need periodic updates. This tool does not store or transmit page content except for the address patterns extracted from clipboard access. No browsing history or personal data is collected or retained.