What you copy is not always what you paste.

The extra line you never saw

Text placed off-screen with CSS, or tucked into a zero-height element, is still part of what you select and copy. The page shows one command; the clipboard gets two. Like invisible ink on a page you photocopy: the copy captures what your eyes skipped.

Why it bites: if the hidden portion ends in a newline, pasting it into a terminal submits it; the second command runs before you have read the first.

Characters that ride along unseen

Zero-width and control characters copy perfectly but display as nothing. A command that reads pip install requests can carry an invisible break, or a look-alike letter, so the thing your shell runs is not the thing you read: an invisible extra character wedged inside a word.

Why it bites: the payload survives a glance, a code font, even a careful proofread. It is not on the screen to be seen.

The paste that presses Enter for you

A snippet ending in a newline runs the moment it is pasted into a terminal. You meant to read it first; the newline did not wait. Bracketed paste stops this only when both sides cooperate: the terminal wraps the paste (near-universal now) and the program reading it neutralises the embedded newline. Modern shells do by default (bash 5.1+, zsh); older or minimal ones do not -- bash before 5.1, POSIX /bin/sh (dash) and busybox ash, and any non-shell prompt (cat, a language REPL, a serial console, ssh into an old box) still submit a multi-line paste immediately.

Why it bites: combined with a hidden line, there is no pause to notice anything: the copy, the paste, and the execution are one motion.

"ClickFix": the fake error that asks you to paste

A page shows a fake CAPTCHA or "fix this error" box and tells you to press Win+R (or open a terminal) and paste. The command was silently pre-loaded onto your clipboard by the page, so you run the attacker's installer thinking you are just proving you are human.

Backdoor path: the pasted one-liner fetches and runs an infostealer or RAT (Lumma Stealer, DarkGate, NetSupport, AsyncRAT), handing over your credentials, session, and a foothold.

Seen in the wild: named by Proofpoint, who coined "ClickFix" from a 100,000-message campaign by the broker TA571. It is now its own MITRE ATT&CK technique (T1204.004), ranked by Red Canary as the #2 initial-access vector of 2025, and adopted by nation-state actors: Kimsuky (DPRK), MuddyWater (Iran) and APT28 (Russia). Microsoft, which tracks the technique too, reports campaigns hitting thousands of devices daily.

Clipper malware: your clipboard, quietly rewritten

Malware on the machine watches the clipboard and swaps what you copied for something else (classically a cryptocurrency wallet address replaced with the attacker's look-alike), so the value you paste is not the value you copied.

Backdoor path: you copy a wallet address and paste it to send funds; the money goes to the attacker. The swap happens silently between copy and paste, with no visible change.

Seen in the wild: a long-running malware class: CryptoShuffler (2017, ~$140k stolen) and the Laplas Clipper malware-as-a-service (2022), which mints a look-alike address matching the first and last characters of yours. More reporting.