Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Execution/ T1204.004

T1204.004Malicious Copy and Paste

T1204.004 — Malicious Copy and Paste is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 6 detection use cases covering it and 133 threat-intel articles citing it.

Execution
View on the matrix → Filter Detection Library MITRE official spec ↗
6Use cases
133Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1204 · User Execution

Use cases covering this technique (6)

Fake CAPTCHA / clipboard-injected PowerShell (ClickFix / FakeCaptcha) Internal exploit · alerting DSΣP [WEEKLY] Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes Internal delivery · alerting DSPDD [WEEKLY] Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) Internal delivery · alerting DSΣP [LLM] AmnesiaStealer ClickFix loader: macOS shell fetching payload from fake-GitHub / Amnesia C2 host Bespoke delivery · alerting DSΣPCS [LLM] macOS ClickFix: Terminal spawns shell decoding Base64 / curl-pipe payload Bespoke delivery · hunting DSΣPCS [LLM] ClickFix mshta.exe silently executing remote HTA then dropping batch (UAT-11795 initial access) Bespoke delivery · alerting DSΣPDDCS

Articles citing this technique (133)

crit CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE art-03
crit Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects art-05
high Hacker claims 3.6 million Azure account records stolen from major companies art-06
high Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection art-08
crit Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic art-10
crit Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access art-23
crit Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies art-25
crit How QR-code phishing can slip past corporate security measures art-27
crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware art-28
high SafePal data breach impacts 39,798 customers, stolen info for sale art-30
crit New AmnesiaStealer macOS malware hijacks browser sessions via remote control art-33
high ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 art-34
crit SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch art-37
crit Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner art-38
high Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware art-40
high Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth art-43
high Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers art-44
crit CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps art-45
high Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware art-46
crit APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit art-48
crit China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud art-49
high GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE art-50
crit ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories art-51
crit New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure art-53
crit AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS art-55
crit WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud art-58
crit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring art-59
crit Attackers Exploit SharePoint Authentication Bypass After Public PoC Release art-63
crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor art-64
high 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One art-66
high OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning art-69
crit Enterprise Defenses Recovered at the Edge and Collapsed Inside art-70
crit Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws art-71
crit Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access art-72
crit Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations art-73
crit SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code art-74
crit ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access art-75
crit Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS art-76
high Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing art-79
crit Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client art-80
crit Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands art-81
high DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt art-82
crit OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development art-84
crit A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices art-85
crit Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo art-86
crit Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers art-88
high Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11 art-89
high Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets art-90
crit Kimwolf v7: An Evolution of the Kimwolf Botnet art-92
crit The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications art-96
high Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise art-97
crit ChainDrop: Inside a Self-Propagating npm Worm art-108
high Token Jacking: Cybercriminals Could Be Stealing Your AI Resources art-112
crit From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide art-116
high Almost Half of Malware Samples Communicate Direct to IP art-132
crit How legitimate cloud platforms enable phishers to bypass MFA art-133
crit Pass the Passkey: A Novel Attack Surface in Passwordless Authentication art-147
crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft art-151
crit The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version art-160
crit OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia art-169
high Four incident-response decisions from the Hugging Face breach art-175
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
crit Russian Global Webmail Espionage art-217
crit Begun, the Patch Wars have art-253
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-256
crit Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories art-259
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-263
crit [GHSA / CRITICAL] CVE-2026-52881: MantisBT: Reflected XSS in admin/install.php via unescaped printf art-265
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-267
high AsyncAPI npm packages backdoored via GitHub Actions art-276
crit ESET Threat Report H1 2026 art-312
high Cyber readiness for SMBs: Getting the basics right art-322
high Multiple @immobiliarelabs Backstage Plugins Compromised on npm art-327
high Inside the inbox: Why cybercriminals want to break into your email account art-337
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-344
high EvilTokens: A phishing attack that doesn’t steal your password art-377
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-396
high Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Ag art-397
crit Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp art-407
high Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp art-408
high Multiple redhat-cloud-services npm Packages compromised art-416
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-468
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-471
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-473
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-474
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-481
crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-488
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-492
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-501
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-503
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-511
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-514
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-528
crit What the ransom note won’t say art-537
high As breakout time accelerates, prevention-first cybersecurity takes center stage art-574
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-578
crit litellm: Credential Stealer Hidden in PyPI Wheel art-587
high A cunning predator: How Silver Fox preys on Japanese firms this tax season art-589
high CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem art-592
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-605
crit EDR killers explained: Beyond the drivers art-613
crit Cyber fallout from the Iran war: What to have on your radar art-626
crit Sednit reloaded: Back in the trenches art-629
crit PlugX Meeting Invitation via MSBuild and GDATA art-648
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-673
med Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan art-719
crit ESET Threat Report H2 2025 art-762
high SHA1-Hulud, npm supply chain incident art-796
med Why Threat Modeling Is Now Even More Critical for AI-Native Applications art-802
crit Phishing Campaign Leveraging the NPM Ecosystem art-846
high npm Supply Chain Attack via Open Source maintainer compromise art-878
crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-917
low AI Trust in Action: How Snyk Agent Redefines Secure Development art-966
med Securing GenAI Development with Snyk art-1128
high The persistent threat: Why major vulnerabilities like Log4Shell and Spring4Shell remain significant art-1264
high Building an npm package compatible with ESM and CJS in 2024 art-1380
high Exploiting HTTP/2 CONTINUATION frames for DoS attacks art-1389
high Ethical hacking techniques art-1721
high Ethical Hacking: Top Tools art-1725
high OSPO security evolution: The Kübler-Ross Model of open source art-1889
crit Key points from Google and Accenture's ransomware white paper art-1958
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2095
crit Targeted npm dependency confusion attack caught red-handed art-2296
high An unintimidating introduction to the dark arts of C/C++ vulnerabilities art-2320
med Snyk Open Source adds C/C++ security scanning for unmanaged dependencies art-2357
high How Snyk helps satisfy White House cybersecurity recommendations art-2477
high dompdf security alert: RCE vulnerability found in popular PHP PDF library art-2481
high Build a software bill of materials (SBOM) for open source supply chain security art-2500
high Snyk joins OpenSSF: Tackling open source supply chain security with a developer-first approach art-3089
high How Dun & Bradstreet and Shutterstock built successful security champions programs art-3091
high Use Snyk security policies to prioritize fixes more efficiently art-3130
high PCI standards open source security requirements — how to comply? art-3525
crit XSS Attacks: The Next Wave art-3664