Chrome warns Enhanced Protection users about ClickFix copy-paste scams
Original title: Chrome flags malicious commands that scammers pass off as fixes
Server-side Gemini now scores fake antivirus and update pages, and clipboard commands are checked after PII is removed.
Google is updating Chrome Enhanced Protection to warn on scam sites and when a page gets users to copy a malicious command, a pattern known as ClickFix. Gemini-based checks moved from an on-device model to a server-side model and now cover fake antivirus and browser-update scams as well as tech-support scams. Clipboard text is stripped of personal data before Safe Browsing review. Full-page red warnings remain for sites already known to be dangerous.
- ClickFix pages can show one command while the clipboard holds another.
- Commands often invoke PowerShell or cmd.exe to download and install malware.
- Page text is sent only after high-confidence scam indicators and is not retained.
- Google says Enhanced Protection users are ten times safer, measured by warnings shown.
Impact: Copied commands can download and install malware outside the browser
- 1.Use Chrome Enhanced Protection so suspicious copied commands are sent to Safe Browsing.
From the original article
2 min read at helpnetsecurity.com
Google is updating Chrome’s Enhanced Protection mode to detect scam websites and warn users when a page tricks them into copying a malicious command. The company introduced Enhanced Protection for Chrome’s Safe Browsing feature in 2020 to address online scams and social engineering.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.