Tooling

Opera has launched a feature called Paste Protect, which it describes as the first native defense in a major browser against clipboard-based attacks. Announced on July 2, 2026, it targets a class of attack known as ClickFix, along with clipboard hijacking and pastejacking, and it is built into Opera's desktop browsers and switched on by default so users are protected with no setup.

How ClickFix and pastejacking attacks work

ClickFix is a social-engineering attack that turns a normal habit against you. It usually starts with something small and ordinary: a video that will not play, or a CAPTCHA that will not quite confirm you are human. A pop-up then offers a fix and tells you to copy a short command and paste it into your computer's terminal or run box.

The command, of course, is malicious, and by pasting and running it you infect your own machine. The trick works because the dangerous step looks like routine troubleshooting, and because the clipboard is a blind spot that browsers have historically not inspected. According to the cybersecurity firm Huntress, ClickFix now accounts for over half of this kind of malware-loading activity, which is what makes a browser-level defense significant.

What Opera's Paste Protect does

Paste Protect adds what Opera calls injection protection: it monitors clipboard activity in real time for potentially malicious commands, whether you copied them yourself or a website placed them there. It uses detection techniques tailored to Windows, macOS and Linux to spot the patterns associated with malicious scripts, rather than relying on a single generic rule.

• Opera Paste Protect launched July 2, 2026, on by default in the desktop browser
• It is billed as the first native defense in a major browser against clipboard attacks
• Targets ClickFix, clipboard hijacking and pastejacking
• ClickFix tricks you into pasting a malicious command into your terminal
• Per Huntress, ClickFix accounts for over half of this malware-loading activity
• The universal defense: never paste a command from a website into a terminal you do not trust

Because it is native and on by default, the protection applies without an extension or configuration. That matters for the people most at risk from ClickFix, who are typically not the users hunting through settings for a security toggle. The defense meets them where the attack happens, at the moment of the paste.

What happens when a paste is blocked

When Paste Protect detects a threat, the copy action is blocked immediately, a warning pops up and explains what happened, and a red icon appears in the address bar. Users can see the first 120 characters of the blocked content, so they get context rather than a blank refusal.

Opera also accounts for legitimate use. Developers who work with trusted sources, and who routinely copy commands from documentation or their own tools, can override a block or mark specific sites as safe. That keeps the feature from becoming an obstacle for the people whose daily work involves pasting real commands.

Why a browser shipping this matters

The wider significance is that a major browser is treating the clipboard as a security surface at all. Copy and paste has been trusted implicitly for decades, and attackers have quietly exploited that trust. If Opera being first here nudges other browsers to add similar protection, the clipboard becomes a little less of a free lane for this kind of attack across the web.

Protecting yourself, whatever browser you use

You do not need to switch browsers to stay safe, because the underlying rule is simple: never paste a command from a web page into your terminal, run box or developer console unless you fully understand it and trust the source. If a site tells you to copy something and run it to fix a video or prove you are human, treat that as a red flag. A browser feature is a useful backstop, but that habit is the real defense.