Clipboard Hijack Script on Web Page Detected

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects attempts to hijack the clipboard on a web page by identifying HTTP responses (flow:to_client) that contain both 'clipboardData' and 'setData' (case-insensitive) in the file data. This combination of keywords suggests a script attempting to read from and write to the client's clipboard, which is a common technique for clipboard hijacking.