GoKawiilOpera has introduced Paste Protect, a security feature designed to block ClickFix-style attacks that trick users into executing malicious commands through social engineering.
ClickFix is a widely used technique where victims are deceived into copying dangerous code or commands to the clipboard and then executing them in the command-line interface.
Typically, the ruse is a verification process or some form of problem-fixing instructions. However, they are only designed to trick the target into performing dangerous actions.
The commands execute with the user’s privileges, bypassing existing security defenses, and many times lead to the delivery of information-stealer malware.
The method is to popular with threat actors that Apple recently introduced a security feature designed specifically to detect risky pastes in the Terminal and block them before alerting the user.
Opera’s approach with Paste Protect is similar: it blocks harmful commands before they are copied to the browser clipboard.
The new security mechanism leverages Hijack protection, introduced in 2021, which can detect attempts from external applications to replace copied content (e.g., URLs or bank account numbers) with malicious alternatives, as well as a new component called Injection protection.
Injection protection blocks potentially harmful commands before they reach the clipboard, regardless if the action is initiated by the user or a website they visit.
Opera says it uses platform-specific detection rules to scan copied content for patterns commonly associated with malicious scripts and commands, supporting Windows, macOS, and Linux.
When Paste Protect detects suspicious clipboard content, it blocks the copy operation, displays a warning, and shows a red security indicator in the browser's address bar.
... continue reading