Clipboard Armor: spot an app that goes online right after you copy something

You copy things you’d never type into a website: passwords, one-time codes, bank details, crypto wallet addresses. Some harmful apps wait for exactly that moment, grab what you copied, and send it out. Clipboard Armor watches for the tell-tale timing.

How it works

• FireAI notices that your clipboard changed. It never reads what’s in it; macOS only tells it “something changed”, and that’s all it keeps: the time.
• If an app then makes its very first connection to a new destination within about three seconds, FireAI adds that coincidence to the connection’s risk facts in Investigate.
• The Clipboard button on the World map lists any connection flagged this way. An empty list is the normal, good case.

Honest limits

• macOS has no way for any app to see which other app read the clipboard. FireAI works from timing, not proof.
• Innocent tools can match the pattern too: a password manager filling a form, or a sync app sending your copied text to your phone.
• It looks at an app’s first connection to a place, so an app that already talks to the same server every day won’t be flagged by this alone.

If a flagged app shouldn’t be online at all, block it in one click. For apps launched from a USB stick, see USB Network Protection.