Closing the Door On ClickFix
Scamming is as old as commerce. Everyone wants to find a shortcut, and people have a tendency to trust easily without looking beyond the surface. The entire basis of social engineering is exploiting that trust for nefarious ends. The Internet of Things is vast, and as such is riddled with vulnerabilities and exploitable flaws. It seems the more we automate services, the more problems we find. I have frequently said that technology is evolving faster than our ability to keep up with it.
The ClickFix technique is a good example. The love child of phishing and social engineering, it’s a popular vector for tricking users into executing malicious commands. It usually appears as a verification step or fake update, mimicking legitimate sites and counting on users not looking at the source code. It generally bypasses existing security measures, because it is a deliberate action on the part of the user rather than an intrusion. It is found in the shortcut of copy/paste, most often seen in MFA. Steganography, the practice of hiding images or commands within the layers of code that don’t show up on the internet facing side – ie, what the user sees – is commonly how attacks are carried out.
ClickFix campaigns are hard to get ahead of, simply because many users just aren’t focused on looking for it when they’re signing into something. MFA is already time consuming, and regularly inefficient. The number of times I’ve waited for a code to appear that doesn’t arrive is much higher than I like, but that’s another conversation entirely. The point is, we just want to get it over with so we can carry on with our day. We aren’t looking for there to be some hidden layer in it (unless you’re me, and therefore rampantly paranoid about online issues).
But that is about to change for some users. Last week, Bleeping Computer reported that Opera, a cross-platform browser, has introduced a native security feature called Paste Protect. In short, Paste Protect scans any bit of code held in the clipboard, that intermediate storage space where copied things go before they get pasted. It is designed to find that steganography, determine whether or not it’s harmful, and if so, blocks it. If it detects suspicious content in the clipboard, it will notify the user with a warning as well as an indicator in the address bar.
Users will still have the option to ignore this warning and carry on with their operation. And in fact can ‘white list’ trusted sites so that interactions with them don’t get flagged by the safety system or turn it off entirely (it’s currently set as active by default). Naturally, there’s a part of me that wonders why anyone would do that. Deliberately turning off a safety feature is like driving without a seatbelt. Sure, it’s a choice, but it can have catastrophic results. Abusing trusted sites is how social engineering works, and honestly, no site should be trusted these days.
Paste Protect isn’t just about blocking ClickFix campaigns, either. According to Opera’s own article on it, it also works to prevent code injection and hijacking of the clipboard by threat actors using RCE. The development of this feature is the last line of defense before execution of a command, since the clipboard is an integral stage of copy/paste. One really should be typing any code or address in by hand, not blindly trusting in the string of characters as presented, but it’s unrealistic to expect users to do that. Copying and pasting predates the internet; we aren’t going to just stop using it. So, I’m very happy to see something being done to protect it.
Posted, 7/6/26