Opera has added Paste Protect, a security feature designed to prevent ClickFix-style attacks where users are tricked into copying and executing malicious commands, according to Opera’s official security blog.
The feature is enabled by default in the latest Opera update and can be accessed via Settings, Privacy & Security, Hit Protect. Opera claims that the system is available for windowsmacOS and linux.
Paste Protect works by scanning copied content for patterns that are commonly linked to malicious scripts and commands before the data reaches the clipboard.
How Opera Paste Protect blocks ClickFix attacks
ClickFix is a common social engineering technique. Victims see what looks like a verification step or troubleshooting instructions, then are guided to copy a code snippet or command to the clipboard and paste it into the operating system’s command-line interface.
The commands are executed with the user’s privileges, which can bypass security measures. This often results in the installation of information-stealing malware.
The method has become widespread enough that Apple recently added a warning to the macOS Terminal to detect risky pastes and alert users before execution.
Opera’s method prevents harmful commands from being copied to the browser’s clipboard. Paste Protect combines two features: hijacking protection, introduced in 2021, which detects attempts by external applications to replace copied content such as URLs or bank account numbers with malicious versions, and injection protection, a new feature that blocks potentially dangerous commands before they reach the clipboard, whether initiated by a user or a website.
Opera explains that Paste Protect uses platform-specific rules to scan copied content for patterns linked to malicious scripts. If suspicious content is found, Paste Protect blocks the copy action, displays a warning pop-up, and displays a red security indicator in the address bar.
Opera claims that if a potential threat is detected, the copy operation is automatically prevented. Users will see a pop-up explaining the situation, along with a red warning icon in the address bar.
How users can review and manage blocked content
Users can see the first 120 characters of the blocked content in the warning pop-up. After a five-second timeout, the pop-up offers an option to approve the copy action if the user believes the content is legitimate. This timeout is intended to prevent users from quickly overlooking the warning without reviewing what was blocked.
For users who frequently copy commands from trusted sources like GitHub, Opera offers the option to create an allowlist. By selecting “Always allow from this site” in the pop-up window, the current site is added to the allow list. Future copy actions from that site will bypass the Paste Protect check.
Opera explains: “If you are confident in your actions, such as a developer who regularly copies scripts or commands from trusted sources like GitHub, you can set certain websites as trusted. By choosing ‘Always allow from this site’ in the pop-up window, you enable copying from these sites without restrictions.”
Paste Protect is enabled by default in the latest version of Opera. Users can review or change these settings through browser settings.
To do this, open Opera, click the Opera menu and select Settings, or press Alt+P. Then navigate to Privacy & Security and select Paste Protect. From there, users can adjust settings, including the list of trusted sites.
For those looking for additional protection against ClickFix-style attacks on macOS, there is also a newly added warning in Terminal. This feature offers similar protection at the operating system level.
What users should know about clipboard security
Even with Paste Protect enabled, Opera still recommends that users avoid running commands they find online unless they fully understand what they do.
For increased clipboard security, it is recommended to treat unexpected “correction” or “verify” instructions with suspicion, especially when they involve pasting content into the Terminal, Command Prompt, PowerShell, or Run dialog box.
Users should verify commands with trusted sources before executing them. It is also useful to use script execution environments that display the exact content before executing it. When it comes to scripts from platforms like GitHub, it is safer to check their origin than to rely on third-party links.
Paste Protect reduces the chance of accidentally copying malicious content, but does not eliminate the need for user judgment when reviewing scripts and commands.
Paste Protect is now available in the latest version of Opera on Windows, macOS, and Linux. Users with older versions of Opera must update via the browser’s built-in update feature to access this new feature.
Opera has not announced any plans to extend Paste Protect to Opera GX, Opera Mini, or other variants of the Opera browser.
The company has not disclosed the specific detection methods used by Paste Protect. Users can follow the Opera security blog for updates on feature development and information on additional protections against emerging clipboard attack techniques.
