OtterCookie clipboard clipper repeatedly invoking pbpaste

Ankit Mehta@Secvyn

•updated Sep 4, 2026•0•0•1

Detects frequent execution of the 'pbpaste' command on macOS, which is used to read clipboard contents. An unusually high volume of executions within a short window can indicate automated data collection or clipboard monitoring, a common technique for credential harvesting or exfiltration of sensitive information copied by the user.