@jubiscreuda12345678 Of course if Opera is set as the default, it could be that he installed some hacked app which is opening those links. Ask him what he recently installed, just before this started.
There are hundreds of sites offering "free" versions of commercial games or other apps, but you never know what else they did while removing that apps security. I'm sure you don't condone that either, but it is possible he didn't try to visit that site.
I mean, more likely something one of his friends sent him, but there are other possibilities.