Chrome Enhanced Protection Adds ClickFix Command Detection and Gemini Scam Warnings

Attackers using ClickFix techniques gain direct access to the operating system by tricking users into pasting malicious code into system terminals. This method bypasses traditional browser download protections because the execution happens outside the browser environment, allowing malware deployment without triggering standard security controls.

How it unfolded

• Google announced on Oct. 20 that it is rolling out improved safeguards in Chrome to counter ClickFix attacks when Enhanced Protection is enabled.
• The update moves scam detection from an on-device model to a more powerful server-side Gemini model for Enhanced Protection users.
• Chrome now sends scrubbed clipboard payloads to Safe Browsing for analysis if a user copies a potential ClickFix script.

Who is affected

Users who enable Chrome's Enhanced Protection mode are the primary recipients of these new defenses. According to Google, this mode makes users ten times safer from phishing and social engineering compared with Standard Protection. The protections apply to users on Windows and Mac systems who might encounter phishing landing pages or malicious ads displaying fake verification errors.

The fix

No traditional patch exists for this social engineering technique, as it relies on user behavior rather than software vulnerabilities. Instead, Google is deploying detection mechanisms that analyze clipboard content and website patterns. If the system determines a copied command is dangerous, Chrome displays a warning to prevent execution. This mitigation is currently limited to users who have manually enabled Enhanced Protection.

What made it possible

ClickFix exploits the trust users place in troubleshooting instructions. Attackers create fake error messages that mimic legitimate services, convincing victims to copy and paste commands into system terminals. This technique serves as an initial access vector by shifting the attack surface from the browser to the operating system. Security teams usually monitor for unusual command-line activity or unexpected PowerShell executions. Check whether endpoint detection tools can identify living-off-the-land binaries being used to download payloads. This approach bypasses perimeter defenses by making the user the delivery mechanism.

What to do and how to stay safe: Google Chrome

• Ensure Enhanced Protection is enabled in Chrome settings for all managed browsers to activate these new safeguards.
• Train users to recognize fake error messages and never paste commands from websites into system terminals or run dialogs.
• Monitor endpoint logs for unexpected executions of PowerShell or Command Prompt, especially following web browsing activity.
• Verify that clipboard monitoring tools are configured to alert on suspicious command patterns before execution occurs.

Step-by-step guide: DDoS Attack Mechanics: Answers to 10 Critical Questions

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this protection work for Standard Protection users?

Google has not confirmed that these ClickFix detection features will be available to users relying on Chrome’s default Standard Protection mode.

How does Chrome analyze the copied commands?

Chrome removes personally identifiable information from the clipboard payload and sends the scrubbed data to Safe Browsing for analysis.

What happens if a site is deemed suspicious but not dangerous?

Chrome displays a lower-severity warning with different text and colors to notify users of deceptive patterns without blocking the page entirely.