Chrome to Warn Users About ClickFix Command Traps

Google has announced new safeguards in Chrome aimed at ClickFix attacks. The protections apply to users who have turned on Enhanced Protection.

How ClickFix works

ClickFix is a popular social engineering trick. Victims are fooled into copying malicious code and pasting it straight into their operating system, sidestepping the browser's usual defenses. Typically a user lands on a compromised site or clicks a malicious ad and is redirected to a phishing page that fakes a Cloudflare or reCAPTCHA check, or reports a non-existent error. The "fix" is a command the user is told to paste into the Windows Run dialog or the Mac Terminal.

One press of Enter sets off a multi-stage infection chain that ends in malware — an information stealer or a remote access trojan. To blend in with normal activity, the commands often lean on living-off-the-land tools such as PowerShell or cmd.exe to pull down later stages.

The technique's strength is that it flips traditional phishing on its head: instead of exploiting vulnerabilities or dangling a suspicious link, it gets users to open the front door themselves under the guise of troubleshooting. As Google notes, moving the download out of the browser and into the terminal fully bypasses Chrome and Safe Browsing download protections.

What Chrome adds

Chrome now detects when an Enhanced Protection user copies a suspicious command. The clipboard payload is scrubbed of any personal information and sent to Safe Browsing for analysis. If the command is judged dangerous, Chrome shows a warning — before the code is ever executed.

In parallel, Google is introducing a taxonomy for Safe Browsing warnings: "suspicious" sites that show deceptive patterns, and "dangerous" sites known to be malicious. To catch tech-support scams, fake antivirus and fake update prompts, an on-device language model evaluates the brand shown, the page's intent and a scam-likelihood score. Page text is sent to the server only on high-confidence indicators and is processed ephemerally — never logged, retained, or used to train models.

Separately, Google is launching Financial Services Verification in the U.S. and Canada: before running certain financial ads, advertisers must show they are authorized by a regulator. In the U.S. Google works with the American Bankers Association, in Canada with the Canadian Bankers Association. The program already operates in Australia, Brazil, India, Indonesia, Malaysia, New Zealand, Türkiye and parts of Europe.

Against this backdrop, Apple unveiled protections in Safari and WebKit (iOS, iPadOS, macOS and visionOS 27) that block "identity resolution" — a practice turning an email address into a persistent tracking ID. Safari blocks, at the domain level, access to the infrastructure that third parties use to receive the harvested addresses.

Source: The Hacker News