Opera just shipped a new security feature called Paste Protect. It’s designed to stop ClickFix-style attacks — the kind that trick you into copying malicious commands and pasting them into a terminal.
If you’re not familiar: ClickFix is a social engineering technique where a fake verification page or error message tells you to copy some text and run it. The text is actually a malicious command. Once you paste and execute, you’re infected — usually with info-stealing malware.
Opera’s approach has two layers. First, there’s Hijack protection (introduced in 2021), which catches external apps trying to swap out copied content — like replacing a bank account number in your clipboard. Second, there’s the new Injection protection, which scans what’s being copied for patterns that look like malicious scripts. If it finds something, it blocks the copy, shows a warning, and puts a red icon in the address bar.
You can still override it if you know what you’re doing. The first 120 characters of the blocked script are shown, and you can approve it after a 5-second timeout. There’s also an allow-list for trusted sites — handy if you regularly copy scripts from GitHub.
Paste Protect is on by default in the latest Opera release. Find it under Settings → Privacy & Security.
Good move from Opera. ClickFix attacks are everywhere right now. Apple added a similar warning to macOS Terminal recently. It’s one of those problems where browser-level defense actually makes sense.
