Opera Ships Paste Protect—First Browser Defense Against ClickFix

Opera rolled out Paste Protect this week, becoming the first major browser to ship native defense against ClickFix attacks—a social engineering technique that became the dominant malware delivery method in 2025, accounting for over half of all malware infections.

What ClickFix Actually Does

ClickFix attacks trick users into copying malicious commands to their clipboard and executing them manually. The typical flow:

1. Victim visits a malicious or compromised site
2. Fake CAPTCHA or "verification" prompt appears
3. Clicking the prompt copies malicious code to clipboard
4. Instructions tell user to open Run dialog (Win+R) or Terminal
5. User pastes and executes the command, infecting themselves

The technique is devastatingly effective because it bypasses most security tools. The user initiates the execution themselves, making it look like legitimate activity rather than malware delivery.

We've covered numerous ClickFix campaigns this year, from WordPress compromises delivering Vidar stealer to macOS attacks using silent DMG mounts. The technique's versatility and effectiveness explain why threat actors adopted it so rapidly.

How Paste Protect Works

Opera's defense combines two mechanisms:

Hijack Protection (existing since 2021): Detects when external applications replace copied content with malicious alternatives without user knowledge.

Injection Protection (new): Scans clipboard content for patterns matching malicious scripts before the copy operation completes. If dangerous content is detected, the copy is blocked entirely.

The system uses platform-specific detection rules for Windows, macOS, and Linux to identify command sequences typically associated with malware delivery—PowerShell encoded commands, curl piped to execution, multi-stage downloaders, and similar patterns.

When triggered, Paste Protect:

• Blocks the copy operation
• Displays a warning popup
• Shows a red security indicator in the address bar
• Displays the first 120 characters of blocked content
• Requires a 5-second timeout before manual override

User Controls

Paste Protect ships enabled by default—users don't need to configure anything. For legitimate use cases like copying code from GitHub or documentation sites, users can:

• Create allowlists for trusted domains
• Select "Always allow from this site" on the warning prompt
• Manually approve individual copy operations after the timeout

Settings are managed through Settings → Privacy & Security → Paste Protect.

Why Other Browsers Should Follow

ClickFix attacks work precisely because browsers don't interfere with clipboard operations. Chrome, Firefox, Edge, and Safari all allow malicious sites to place arbitrary content in the clipboard without user awareness.

The Ghost CMS ClickFix campaign compromised sites at Harvard and Oxford, demonstrating that even trusted domains can serve ClickFix attacks when underlying CMS vulnerabilities are exploited.

Browser-level defense is the right layer for this problem. Security tools monitoring process execution see the user manually running commands, which is difficult to distinguish from legitimate administration. Blocking the malicious content at the clipboard stage prevents the attack before execution.

Limitations

Paste Protect isn't a complete solution. Sophisticated attackers can:

• Split commands across multiple clipboard operations
• Use encoding or obfuscation to evade pattern matching
• Instruct users to type commands rather than paste them

The feature adds friction to attacks, forcing threat actors to adapt their techniques. That adaptation reduces attack success rates even when bypasses exist.

What Users Should Know

Even with Paste Protect enabled, the fundamental defense remains user awareness. No security tool can protect users who deliberately ignore warnings and execute unknown commands.

If any website instructs you to open a command prompt or terminal and paste something, treat it as suspicious regardless of how legitimate the site appears. Legitimate services essentially never require this.

Opera users should update to the latest version to receive Paste Protect. Users of other browsers should maintain vigilance against ClickFix attacks until their vendors ship comparable defenses.