InvisibleFerret Clipboard Harvesting via Python or Node Clipboard APIs

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects processes associated with scripting languages like Python and Node.js that are attempting to access clipboard data or use clipboard-related libraries (e.g., pyperclip, win32clipboard, xclip). This behavior is common in info-stealer malware, such as InvisibleFerret, which uses the clipboard to harvest sensitive user data.