Opera's new Paste Protect tries to stop the copy-paste scam that's been draining wallets
The browser will now block dodgy commands before they reach your clipboard, targeting the ClickFix trick that has become criminals' favourite way to trick people into infecting their own computers.
Key points
- Opera has switched on Paste Protect by default in its latest browser release to block a scam known as ClickFix.
- ClickFix tricks people into copying a hidden command from a website and running it themselves, which installs malware.
- The feature works on Windows, macOS and Linux, flagging a red warning in the address bar when it blocks something.
- Apple recently added a similar check to its Terminal app, showing how common the attack has become.
- Users can allow-list trusted sites like GitHub if they copy code for legitimate reasons.
Opera has rolled out a feature called Paste Protect that tries to shut down one of the most effective scams doing the rounds this year. It's aimed at ClickFix, a trick where a website tells you there's a problem with your browser, or asks you to prove you're human, and helpfully offers a command to "fix" it.
Copy the command, paste it into your computer's command line (the text interface where power users type instructions), hit enter. You've just installed malware on yourself. That's the whole con. The command usually pulls down an info-stealer: software that scrapes saved passwords and crypto wallets off your machine and sends them to the attackers.
The reason it works is that the victim types the final keystroke. Every antivirus and endpoint tool on the box sees a user running a legitimate shell command, because that's exactly what happened.
How is Opera actually stopping this?
Paste Protect inspects what's about to land on your clipboard and blocks it if it looks like a script or shell command. First reported by BleepingComputer, the feature sits on top of an older tool called Hijack Protection that Opera shipped in 2021 to stop websites silently swapping a copied bank account number for the attacker's.
The new component is called Injection Protection. It scans copied text against patterns the browser associates with malicious commands, per operating system, so the rules for a Windows PowerShell one-liner differ from a macOS Terminal command.
When something trips the filter, the copy is blocked, a popup appears and a red icon shows up in the address bar. You get to see the first 120 characters of whatever was stopped. Approve the copy after a five-second delay if you genuinely want it.
Developers who paste snippets from GitHub all day can add trusted sites to an allow-list so they aren't nagged constantly.
Should ordinary users care?
Yes. We've tracked 33 ClickFix stories in the last 90 days, including researchers pulling roughly 3,000 live payloads from active infrastructure, and the volume shows no sign of dropping. Fake CAPTCHA pages are the most common wrapper, but the technique also turns up disguised as Zoom errors, Word document repair prompts and browser update nags.
Apple thought the problem serious enough that recent versions of macOS now flag risky pastes into Terminal before they run.
The failure mode here is a human one. No patch fixes it, because nothing is technically broken: the operating system is doing exactly what you told it to. A browser-level speed bump is a reasonable stopgap.
One thing worth saying plainly: if a website ever asks you to open a command prompt or paste anything into Terminal, close the tab. No legitimate website needs you to do that.
Paste Protect is on by default in the latest Opera build and can be toggled at Settings → Privacy & Security → Paste Protect. Chrome, Edge and Firefox users don't get it, and there's no sign yet that they will.
Operational takeaway: assume your users will paste whatever a convincing popup tells them to, and build detection around the shell, not the browser.
