Google is rolling out new defenses in Chrome aimed at shutting down ClickFix attacks—those phishing-style cons where users are duped into copying malicious commands under the guise of resolving errors. The added protections are active when users have Enhanced Protection enabled. What’s changing directly addresses how attackers bypass standard browser safety features by shifting malicious behavior outside the browser.
What Is ClickFix and Why It’s Sneaky
ClickFix scams trick people into pasting commands into a system utility—such as the Windows Run dialog or the Mac Terminal—after seeing fake verification messages or errors. Once the command is executed, it can unlock a pipeline for malware like remote access trojans or info stealers. Because the harmful commands are run outside the browser, traditional defenses like Safe Browsing don’t pick up the threat early.
How Chrome Is Fighting Back
When Enhanced Protection is turned on, Chrome will now monitor the clipboard whenever a user copies a suspicious command. The browser then scrubs any personal data and sends the clipboard content to Safe Browsing for threat analysis. If a command appears dangerous, Chrome will show a warning before the user can execute it.
Alongside this change, Google is adding more fine-grained site warning categories: sites showing deceptive but novel behavior will be classified as “Suspicious,” while known malicious sites will be labeled “Dangerous.” These warnings are meant to reflect how certain sites operate—even before a full investigation confirms wrongdoing.
Another front in the assault on phishing: Chrome is increasingly using on-device large language models to catch scams like fake antivirus alerts and fraudulent site updates. These LLMs look at page content, brand signals, and other cues to compute a “scam likelihood score.” When a page shows high-risk signs, Chrome evaluates it—only sending content off-device when necessary, and doing so in a transient way that doesn’t store user data or feed training pipelines.
For ad safety in the U.S. and Canada, Google is also tightening rules. Advertisers dealing in financial services must now prove regulatory credentials before running ads. This verification step, already in place in several other markets, is meant to curb impersonation scams using well-known financial brands.
Details at a Glance:
- Enhanced Protection users get clipboard threat scanning and warnings for dangerous commands.
- Sites will receive new warning tiers: Suspicious vs Dangerous.
- LLMs will help detect tech support and similar scams, with privacy-preserving design.
- Financial ads must now be verified by regulators in the U.S. and Canada.
This rollout of protections starts now but is tied to users having Enhanced Protection enabled in their Chrome settings. Without it, the new warnings and classification changes may not apply.
Why It Matters: ClickFix represents a social engineering vector that takes advantage of users’ trust and basic system functions. By moving detection into Chrome itself and tying it to system-level actions, Google is making a bet that prevention is possible—before malware ever executes. What to watch next: whether these warnings reduce successful ClickFix attacks, how site classification tiers are enforced, and whether false positives undermine trust in the system.
