Clipboards have already been established as potential attack vectors. By now, malicious actors’ ability to use HTML/CSS tricks designed for developers to copy malicious code is well-documented.

But according to SecurityWeek, there’s an emerging copy concern on the Web: pastejacking. This process uses Java instead of CSS, which makes the exploit more powerful and harder to detect, and it could have serious consequences if paired with a phishing attack.

Here’s a rundown of the new paste problem.

Devil in the Details

Security expert Dylan Ayrey told SecurityWeek the use of JavaScript means “text can be copied after an event, it can be copied on short timer following the event, and it’s easier to copy in hex characters into the clipboard, which can be used to VIM.”

His proof of concept showed what happens when users paste commands copied from a Web browser into their terminal: While it may appear that they are copying the line echo “not evil”, they’re in fact getting echo “evil\n.

This is a small difference, but a critical one — \n means “newline” and ensures that any command is automatically executed when pasted without the need to press a key.

As a result, victims may not even see the malicious code they’re copying before it starts to run. The exploit isn’t viable in Safari, while apps such as iTerm and Windows console emulator Cmder show warnings whenever the newline character is used.

Hands-Free Pastejacking

So how do attackers convince potential victims to copy/paste malicious code? It’s easier than it appears. As noted by Softpedia, users don’t even need to copy all the malicious code; a single character is enough to start the process. What’s more, it’s possible for actors to add pastejacking JavaScript to an entire Web page so that any text copying results in potential infection.

Even worse? JavaScript gives cybercriminals the power to run their code, clear the console and then paste the originally selected text, leaving users with no clue that they’ve been compromised.

There is a silver lining, since most users are now tech-savvy enough to avoid copy/paste commands on websites that don’t seem above-board. The problem? That’s the least likely attack vector.

Instead, it’s a safe bet that cybercriminals will bundle malicious code into a phishing email scam. If they convince users to copy in-mail text or do the same at a supposedly secure site, victims could unwittingly infect their own machines.

There’s also the possibility of exploiting popular tech support sites. With more users now willing to search for help online before contacting IT departments, compromising a code repository with pastejacking JavaScript could help attackers slip past the security senses of even Web-wary users.

Clipboard concerns are back, and this time it goes beyond CSS. More adaptable JavaScript makes CTRL-V a viable attack vector.