Opera has introduced Paste Protect, a security feature that blocks ClickFix-style attacks by preventing users from unknowingly executing malicious commands. The feature targets social engineering tactics that exploit the paste functionality in browsers.
ClickFix attacks trick users into copying and pasting malicious commands into system terminals or browser consoles. Attackers typically distribute fake error messages or support scams that prompt victims to paste code, which then executes without the user understanding what it does.
Opera's Paste Protect works by intercepting paste operations in sensitive areas like browser consoles and command execution contexts. When a user attempts to paste content into these high-risk zones, the browser displays a warning and requires explicit confirmation before allowing the paste to complete.
The feature addresses a growing threat vector. Security researchers have documented ClickFix campaigns distributing malware, cryptocurrency stealers, and remote access trojans through seemingly legitimate support alerts. Users often comply with instructions from what appears to be official support channels, lowering their guard during the paste operation.
Opera joins other browser developers in implementing protections against this attack class. Chrome and Firefox have deployed similar paste-blocking measures in console environments. The feature reflects broader industry recognition that social engineering exploits require technical barriers alongside user awareness.
Paste Protect operates silently during normal browsing but activates when code-execution contexts are detected. This approach balances security with usability—legitimate development workflows remain unimpeded while high-risk operations receive additional scrutiny.
The rollout represents incremental hardening rather than a complete defense. Attackers continue to evolve techniques, including using obfuscated scripts and multiple-stage payloads. Users should remain cautious about executing pasted code from untrusted sources, even with browser-level protections in place.
Opera did not specify deployment timeline or platform availability for Paste Protect.
U.S. federal prosecutors have unsealed charges against three Russian nationals accused of operating a bulletproof hosting service that supported ransomware gangs responsible for over $62 million in damages worldwide.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that attackers are actively exploiting three vulnerabilities in Internet-exposed on-premises SharePoint Server instances. Organizations running affected versions must patch immediately.
Tailscale disclosed a critical vulnerability in its SSH implementation that allowed attackers to gain root access through insecure argument handling. The flaw has been patched in recent versions.
A new study found that social media platforms referred over 5.7 million visits to nonconsensual deepfake pornography sites between December 2025 and March 2026, with YouTube and X accounting for the majority of traffic.