Opera’s new Paste Protect feature prevents clipboard attacks that your antivirus may not detect.

      Most online scams are relatively easy to identify once you know what signs to look for. Indicators such as fake login pages, dubious attachments, or urgent requests for wire transfers are clear signs of a scam. However, ClickFix doesn’t fit this mold. It presents itself as a helpful tool and prompts you to perform a common task that few consider questioning.

      This method was responsible for over 53 percent of malware loader incidents last year, according to the cybersecurity firm Huntress, and until now, no leading browser provided a built-in defense against it. Opera is addressing this issue with a new feature known as Paste Protect.

      Why ClickFix bypasses your computer's current defenses

      A typical ClickFix attack starts on a webpage that claims something has gone wrong, such as a video that won't play or a repeatedly failing CAPTCHA. The page guides you through a solution, which involves copying a command and executing it on your computer. This command can install malware, compromise saved passwords, or grant an attacker remote access to your device.

      ClickFix attacks are particularly successful because you are the one executing these actions, rather than an external threat that antivirus software is designed to detect. A command you paste into the terminal does not match that profile, and most security tools do not scrutinize your clipboard.

      Another exploit, known as clipboard hijacking, exploits the same vulnerability in a different manner. Instead of deceiving you into copying something harmful, it waits for you to copy something legitimate and silently replaces it. For example, if you copy a bank account number or a cryptocurrency wallet address and paste it somewhere, what gets pasted may actually belong to an attacker. Opera’s Paste Protect aims to defend against both types of attacks.

      What Paste Protect actually does

      In a blog post, Opera outlines that Paste Protect comprises two distinct components. The first, Hijack protection, has been part of Opera since 2021, monitoring your clipboard for unauthorized modifications made by external applications. If something attempts to replace what you've copied without your consent, it is caught before you paste it.

      The newer addition is Injection protection, which examines clipboard content in real time and checks it against patterns commonly linked to malicious scripts on Windows, macOS, and Linux. If something is flagged, the copy action is halted immediately, and a warning pop-up appears explaining what was detected. A red icon is also displayed in the address bar, and you can expand the alert to view the first 120 characters of the blocked content.

      Paste Protect is automatically enabled on the desktop version of Opera, so there’s no need to adjust any settings for protection against ClickFix attacks. If you’re a developer who frequently copies commands from trusted sources like GitHub, you can bypass the block with a five-second hold or permanently whitelist specific websites through the Privacy and Security section in Opera’s settings.

      Currently, no other major browser offers comparable native protection. Chrome users can install third-party extensions like ClickFix Block for some level of security, but this requires prior knowledge of the potential threat. As of now, Paste Protect makes Opera the only major browser with built-in protection by default.