You’re on a page that looks exactly like a Cloudflare Turnstile CAPTCHA. “Press and hold to verify you are human,” it says. You do. Nothing odd happens. Then the page tells you to press Win+R, Ctrl+V, and hit Enter. Something you didn’t consciously copy is now in your clipboard, and if you follow the instructions, a hidden PowerShell window executes a command that downloads malware without ever writing an executable to disk. You just got ClickFix’d.
In 2025, ClickFix accounted for approximately 53% of malware-loading cyber attacks, a 517% year-over-year surge documented by ESET. This was not a spike in user gullibility. It was the market discovering that the clipboard is an unguarded passage between the web and the command line, and that no existing security product was watching it.
On 2 July 2026, Opera launched Paste Protect, becoming the first major browser to ship native clipboard-attack defence. This article walks you through how ClickFix works at a technical level, why it evaded every traditional defence layer, and how Paste Protect closes the gap from inside the browser — one dimension of Opera’s broader security renaissance.
What Are ClickFix Attacks and Why Did They Dominate Malware Delivery in 2025?
ClickFix is a social engineering technique where attackers trick users into copying, pasting, and executing malicious commands, typically PowerShell one-liners, via the Windows Run dialog or macOS Terminal. Victims are lured through fake CAPTCHA pages, software update prompts, or error messages. JavaScript on the landing page silently replaces clipboard content with an obfuscated command string while the user sees only innocuous text.
Because the user manually launches the command, the resulting process chain appears as legitimate user activity. That distinction is what lets ClickFix bypass application whitelisting, antivirus signature matching, and behavioural detection: the system cannot tell the difference between a user running PowerShell and an attacker running PowerShell through the user.
The kill chain works in six stages. First, the victim arrives at a malicious page through phishing, malvertising, SEO poisoning, or a compromised WordPress site. Second, the page renders a convincing fake interface: a reCAPTCHA, Cloudflare Turnstile, or Windows security dialog. Third, JavaScript uses navigator.clipboard.writeText() to inject an obfuscated command into the clipboard. Fourth, the page instructs the user to open the Run dialog, paste, and press Enter. Fifth, a trusted system binary like PowerShell, mshta, or curl fetches and executes a second-stage payload in memory. Sixth, the malware loader delivers the final payload with nothing touching disk.
This reliance on living-off-the-land binaries, or LOLBins, is what makes ClickFix fileless and hard to detect. PowerShell cmdlets such as iwr, irm, and iex are the most prolific execution methods observed. These are legitimate administrative tools, so their execution from a user-initiated Run dialog does not inherently trigger antivirus alerts. MITRE ATT&CK maps these techniques to T1059.001 (PowerShell), T1204.002 (malicious file execution via user interaction), and T1566.001 (spearphishing).
The payload families delivered through ClickFix tell you who the attackers are targeting and why. Lumma Stealer, the most prevalent, compromises saved passwords, browser autofill data, cookies, and cryptocurrency wallets. NetSupport RAT provides persistent remote access for hands-on-keyboard activity. DarkGate is a commodity loader that can keylog, mine cryptocurrency, and download additional payloads. AMOS and Poseidon, the macOS variants, target credential and cryptocurrency theft. A June 2025 campaign targeting macOS users demonstrated the technique was no longer Windows-only. Huntress incident response data and Recorded Future Insikt Group campaign tracking confirm ClickFix as the initial access mechanism across all these families.
Three variants exist, each signalling where the attack is heading. ClickFix targets the Run dialog and remains dominant by volume. FileFix, a mid-2025 variant documented by researcher mrd0x, replaces Run with File Explorer’s address bar: victims press Ctrl+L and paste a command formatted to look like a file path. JackFix adds real-time clipboard monitoring, replacing cryptocurrency wallet addresses with attacker-controlled alternatives. FileFix is limited in the wild for now, but it signals attacker innovation.
The scale comes down to three compounding factors. Verification fatigue: years of conditioning to treat CAPTCHAs as routine friction has trained users to comply without scrutiny. Muscle memory: Ctrl+V is automatic, and the pasted command is rarely inspected. And third, commoditisation: ClickFix builder kits sold for $200 to $1,500 per month on hacker forums since late 2024, offering configurable lures, anti-VM detection, and UAC bypass. When you can subscribe to an attack like you subscribe to a SaaS product, volume follows. And when a technique that effective is available as a subscription service, the only question is where the defence lives. Opera’s answer: inside the browser.
How Does Opera Paste Protect Defend Against ClickFix Clipboard Attacks?
Opera shipped Hijack Protection in 2021, which detected unauthorised modifications to browser settings and search engines, and also protected the clipboard from hijack attempts where, for example, a cryptocurrency address would be silently swapped. Paste Protect extends that clipboard-awareness philosophy to the external paste surface: the boundary between browser-rendered content and OS-level command execution. Mohamed Salah, Senior Director of Product at Opera, put it plainly: Opera had been protecting users from paste hijacking for half a decade, and it made sense to expand that protection to address one of the most serious online threats. This security-first posture parallels Opera’s decision to keep Manifest V2 support alive.
Paste Protect monitors clipboard content in real time for patterns resembling obfuscated commands: Base64-encoded strings, concatenated PowerShell fragments, suspicious execution chains, and platform-specific attack signatures for Windows, macOS, and Linux. When a malicious pattern is detected, Opera intercepts the clipboard write and displays a warning dialogue showing the actual command content, breaking the obfuscation that makes ClickFix effective. The intercepted content never reaches the system clipboard unless the user chooses to override the warning.
The feature is not signature-based. It analyses command structure and obfuscation patterns, making it effective against novel techniques that hash-based scanners would miss. Windows detection targets PowerShell invocation patterns, mshta calls, and Base64-encoded payloads. macOS detection targets shell command chains and sudo-based quarantine bypasses. Linux detection covers analogous shell injection patterns.
For everyday users, Paste Protect is invisible. Copying text, links, images, and code snippets from trusted websites proceeds normally. The warning only triggers when clipboard content matches obfuscated command patterns. For developers who routinely copy legitimate commands from Stack Overflow or GitHub documentation, the occasional false positive is handled with a five-second “Hold to Copy” override or a site allowlisting feature. The setting lives under Privacy and Security in Opera’s preferences, and it is enabled by default.
The limitations are worth acknowledging. Paste Protect cannot prevent a user from manually typing a malicious command, nor can it inspect clipboard content from non-browser sources after it leaves the browser context. It narrows the ClickFix attack surface but does not eliminate it. And no other major browser offers equivalent clipboard monitoring: Chrome, Edge, and Firefox rely on Google Safe Browsing and Microsoft Defender SmartScreen, which evaluate URLs and downloaded files but do not inspect clipboard content. On every other major browser, a ClickFix attack can execute its full clipboard injection path without encountering a single browser-layer check.
The 517% surge in ClickFix attacks was the market discovering an unguarded passage between two security domains and flooding through it. Paste Protect is the first product to claim that passage as its territory. Whether or not it becomes an industry standard, it has changed the conversation: the browser has become a legitimate layer in the defence stack.
Paste Protect closes the gap ClickFix exploits: the moment between a webpage writing to the clipboard and a user pasting into a command interface. The feature’s lineage from Hijack Protection reveals Opera’s thesis that the browser is positioned to inspect clipboard transitions in a way no other security layer replicates. The open question is whether browser-native security features will remain niche differentiators or become table-stakes expectations, and whether features like this actually shift browser adoption when platform defaults dominate. For the full picture of Opera’s security positioning — spanning ClickFix defence, ad-blocking policy, enterprise architecture, and market dynamics — the companion articles in this cluster examine each dimension.
Frequently Asked Questions
How do I know if I’ve been targeted by a ClickFix attack?
The most immediate warning sign is a website instructing you to open the Run dialog or Terminal and paste something you did not consciously copy. Legitimate services never ask users to paste commands into system interfaces as a verification step. If you see a CAPTCHA page that ends with instructions to press Win+R and Ctrl+V, close the tab immediately. After the fact, look for unusual PowerShell entries in Windows Event Logs (Event ID 4104) or unexplained outbound network connections to unfamiliar domains.
Is Opera Paste Protect available on Opera GX and Opera for mobile?
As of the July 2026 launch, Paste Protect ships in Opera One on desktop (Windows, macOS, and Linux). Opera has confirmed the feature will roll out to Opera GX in a subsequent update, though no specific date has been announced. Mobile versions of Opera do not include Paste Protect, partly because mobile operating systems sandbox clipboard access more aggressively and the Win+R paste vector does not exist on iOS or Android. The feature is enabled by default on supported platforms with no configuration required.
Can ClickFix attacks affect Linux users?
Yes, although Linux is a smaller target by desktop market share. Paste Protect includes Linux-specific detection patterns that catch shell command chains, pipe constructions, and curl-to-bash injection attempts. The attack mechanics are identical: a malicious webpage injects an obfuscated command into the clipboard, and the user is socially engineered into pasting it into a terminal. The lower attack volume on Linux reflects economics rather than immunity. Threat actors focus resources where the largest victim pool exists.
Why can’t traditional antivirus software detect ClickFix attacks before they execute?
Antivirus products are built to detect malicious files, not malicious clipboard content. A ClickFix command is a string of text sitting in the clipboard buffer. It has no file signature, no executable header, and no process to scan. When the command is eventually pasted into the Run dialog, it invokes a legitimate signed Microsoft binary like PowerShell, which antivirus engines are trained to trust as a system administration tool. The attack only becomes visible at execution, and by then the payload is already in memory. This is the architectural blind spot Paste Protect was designed to close.
What should I do if I accidentally ran a ClickFix command?
Act immediately, in this order: disconnect the device from the network to sever any active command-and-control channel, run a full scan with an up-to-date endpoint detection tool (Windows Defender is adequate for initial triage), and change all passwords from a clean device, starting with email, financial, and social media accounts. If you use a password manager, check for unauthorised access attempts. For organisations, isolate the affected endpoint and initiate incident response procedures. The Huntress and Recorded Future teams have published detailed remediation guides for Lumma Stealer and other ClickFix-delivered payloads.
Do any other browsers offer clipboard protection like Opera Paste Protect?
No. As of mid-2026, Opera Paste Protect is the only browser-native clipboard monitoring feature that inspects content for obfuscated command patterns before it reaches the system clipboard. Chrome, Edge, and Firefox rely on Google Safe Browsing and Microsoft Defender SmartScreen, which evaluate URLs and downloaded files but do not inspect clipboard content. Brave has no equivalent feature. This is not a trivial gap: it means that on every other major browser, a ClickFix attack can execute its full clipboard injection path without encountering a single browser-layer check.
How is ClickFix different from traditional pastejacking?
Traditional pastejacking, first demonstrated around 2016, relied on tricking users into pasting content that was different from what they had copied, typically by appending malicious lines after legitimate text via JavaScript. ClickFix is a more sophisticated evolution: it uses the full modern clipboard API to replace content silently, applies multiple layers of obfuscation (Base64 encoding, string splitting, escape characters), and targets a specific execution path through the Run dialog rather than generic terminal pasting. The difference is between a crude bait-and-switch and a precision-engineered kill chain designed to evade detection at every stage.
Is it true that using a password manager protects against ClickFix attacks?
No. A password manager protects credentials by auto-filling login fields on legitimate websites and detecting phishing domains that do not match stored URLs. It cannot intervene when you paste a command into the Windows Run dialog or Terminal, because those are operating system interfaces, not browser form fields. The password manager has no visibility into the clipboard at that transition point and no mechanism to warn about obfuscated PowerShell commands. Password managers and Paste Protect operate in entirely different security domains; they complement each other but do not overlap.
Does Paste Protect affect everyday copy-paste workflows?
For the vast majority of users, Paste Protect is invisible. Copying text, links, images, and code snippets from trusted websites proceeds normally. The warning dialogue only triggers when the clipboard content matches obfuscated command patterns: Base64 strings, concatenated PowerShell fragments, or suspicious execution chains. Developers and system administrators who routinely copy legitimate commands from platforms like Stack Overflow or GitHub documentation may encounter the occasional false positive. The five-second “Hold to Copy” override and the site allowlisting feature are designed to minimise this friction without disabling the protection globally.
How do attackers get fake CAPTCHA pages in front of victims?
Attackers use four primary delivery channels. The most common is phishing emails containing links to compromised or attacker-controlled domains hosting the fake CAPTCHA landing page. SEO poisoning places malicious pages in search results for trending software downloads and tutorials. Malvertising injects redirects through compromised ad networks onto legitimate websites. Compromised sites, particularly WordPress instances with outdated plugins, are hijacked to serve the ClickFix lure directly to unsuspecting visitors. Discord CDN links are also used to distribute the landing pages. The diversity of delivery vectors is part of what makes ClickFix so difficult to block at the perimeter.
Will ClickFix attacks disappear now that Paste Protect exists?
No single feature eliminates an attack class, especially one with a 517% growth trajectory and a mature builder-kit economy behind it. Paste Protect raises the cost and reduces the success rate of ClickFix attacks against Opera users, but the technique will persist on other browsers and evolve to test Paste Protect’s pattern detection. Attackers have already demonstrated adaptive behaviour with FileFix, which shifts the paste target from the Run dialog to File Explorer’s address bar. The more realistic outcome is an arms race: Paste Protect closes the obvious clipboard gap, and attackers search for the next unmonitored transition point.
