Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Execution/ T1204.004

T1204.004Malicious Copy and Paste

T1204.004 — Malicious Copy and Paste is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 7 detection use cases covering it and 117 threat-intel articles citing it.

Execution
View on the matrix → Filter Detection Library MITRE official spec ↗
7Use cases
117Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1204 · User Execution

Use cases covering this technique (7)

Fake CAPTCHA / clipboard-injected PowerShell (ClickFix / FakeCaptcha) Internal exploit · alerting DSΣP [WEEKLY] Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes Internal delivery · alerting DSPDD [WEEKLY] Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) Internal delivery · alerting DSΣP [LLM] ClickFix RunMRU entry launching rundll32 against WebDAV GUID share (ACR Stealer) Bespoke delivery · alerting DSΣPDDCS [LLM] MSHTA remote HTA launched by explorer→powershell chain (ACR Stealer fileless campaign) Bespoke delivery · alerting DSΣPDDCS [LLM] ClickFix mshta.exe silently executing remote HTA then dropping batch (UAT-11795 initial access) Bespoke delivery · alerting DSΣPDDCS [LLM] OpenClaw paste-site (rentry.co/glot.io) curl-pipe-bash semantic-hijack dropper Bespoke delivery · hunting DSΣPCS

Articles citing this technique (117)

crit Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet art-00
crit Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data art-01
high Four incident-response decisions from the Hugging Face breach art-04
crit Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads art-06
crit Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory art-12
crit Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape art-13
crit Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline art-18
high Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments art-19
crit Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser art-22
crit Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass art-26
crit OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach art-27
crit New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands art-28
crit Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates art-29
high Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process art-43
crit 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login art-44
crit JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach art-47
crit Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root art-48
crit Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays art-49
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-50
crit Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In art-51
crit Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit art-52
crit Mirage Kitten targets Middle East and Africa region with new malware art-53
crit Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw art-55
high NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework art-57
crit Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption art-58
crit Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw art-61
crit n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process art-63
high Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update art-64
crit Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware art-65
crit TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments art-66
high GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption art-67
crit CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking art-74
crit BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery art-96
high ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link art-99
crit Golden Chickens Resurfaces With Four New Malware Families and Modular Implants art-103
crit Email threat landscape: Q2 2026 trends and insights art-108
crit Russian Global Webmail Espionage art-111
high ACR Stealer: Two observed intrusion chains amid increased threat activity art-146
crit Begun, the Patch Wars have art-150
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-156
high Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery art-157
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-163
crit [GHSA / CRITICAL] CVE-2026-52881: MantisBT: Reflected XSS in admin/install.php via unescaped printf art-165
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-168
crit OkoBot: new sophisticated malware framework targets cryptocurrency users art-169
high AsyncAPI npm packages backdoored via GitHub Actions art-181
crit ESET Threat Report H1 2026 art-221
crit Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation art-223
crit When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website art-246
high Cyber readiness for SMBs: Getting the basics right art-249
crit Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign art-250
high Multiple @immobiliarelabs Backstage Plugins Compromised on npm art-272
crit Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector art-280
high Inside the inbox: Why cybercriminals want to break into your email account art-285
crit CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure art-293
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-294
crit OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat art-302
high EvilTokens: A phishing attack that doesn’t steal your password art-331
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-350
high Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Ag art-351
crit Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp art-361
high Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp art-362
high Multiple redhat-cloud-services npm Packages compromised art-370
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-422
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-425
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-427
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-428
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-435
crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-442
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-446
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-456
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-458
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-466
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-469
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-483
crit What the ransom note won’t say art-492
high As breakout time accelerates, prevention-first cybersecurity takes center stage art-530
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-535
crit litellm: Credential Stealer Hidden in PyPI Wheel art-545
high A cunning predator: How Silver Fox preys on Japanese firms this tax season art-548
high CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem art-551
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-565
crit EDR killers explained: Beyond the drivers art-577
crit GlassWorm Hides a RAT Inside a Malicious Chrome Extension art-580
crit Cyber fallout from the Iran war: What to have on your radar art-593
crit Sednit reloaded: Back in the trenches art-596
crit PlugX Meeting Invitation via MSBuild and GDATA art-615
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-640
med Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan art-687
crit ESET Threat Report H2 2025 art-732
high SHA1-Hulud, npm supply chain incident art-766
med Why Threat Modeling Is Now Even More Critical for AI-Native Applications art-772
crit ESET APT Activity Report Q2 2025–Q3 2025 art-793
crit Phishing Campaign Leveraging the NPM Ecosystem art-823
high npm Supply Chain Attack via Open Source maintainer compromise art-855
crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-894
low AI Trust in Action: How Snyk Agent Redefines Secure Development art-943
med Securing GenAI Development with Snyk art-1105
high The persistent threat: Why major vulnerabilities like Log4Shell and Spring4Shell remain significant art-1241
high Building an npm package compatible with ESM and CJS in 2024 art-1357
high Exploiting HTTP/2 CONTINUATION frames for DoS attacks art-1366
high Ethical hacking techniques art-1698
high Ethical Hacking: Top Tools art-1702
high OSPO security evolution: The Kübler-Ross Model of open source art-1866
crit Key points from Google and Accenture's ransomware white paper art-1935
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2072
crit Targeted npm dependency confusion attack caught red-handed art-2273
high An unintimidating introduction to the dark arts of C/C++ vulnerabilities art-2297
med Snyk Open Source adds C/C++ security scanning for unmanaged dependencies art-2334
high How Snyk helps satisfy White House cybersecurity recommendations art-2454
high dompdf security alert: RCE vulnerability found in popular PHP PDF library art-2458
high Build a software bill of materials (SBOM) for open source supply chain security art-2477
high Snyk joins OpenSSF: Tackling open source supply chain security with a developer-first approach art-3066
high How Dun & Bradstreet and Shutterstock built successful security champions programs art-3068
high Use Snyk security policies to prioritize fixes more efficiently art-3107
high PCI standards open source security requirements — how to comply? art-3502
crit XSS Attacks: The Next Wave art-3641