Chrome warns Enhanced Protection users before they run ClickFix commands
Original title: Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands
Copied commands are scrubbed and checked by Safe Browsing, and Chrome is also expanding scam and financial-ad checks.
Google is rolling out Chrome warnings for Enhanced Protection users who copy commands used in ClickFix attacks. Victims are sent from compromised sites or malicious ads to fake verification or error pages and told to paste commands into Windows Run or Mac Terminal, often through PowerShell or cmd.exe, which then fetch stealers or remote access trojans. The clipboard payload is stripped of personal data and sent to Safe Browsing before the user runs it. Google is also adding scam-site labels, on-device scam checks, and financial-ad verification in the US and Canada.
- Fake pages imitate Cloudflare or Google reCAPTCHA checks and other errors.
- Commands often use PowerShell or cmd.exe to download the next stage.
- Page text leaves the device only for high-confidence scam signs and is not kept.
- Financial Services Verification is expanding to the United States and Canada.
- Safari and WebKit in version 27 releases block identity-resolution domains.
Impact: Users run pasted commands that deploy stealers or remote access trojans
- 1.Enable Chrome Enhanced Protection to get warnings before running copied ClickFix commands
- Countries
- United StatesCanada
From the original article
4 min read at thehackernews.com
Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which bad actors trick users into copying and pasting malicious code directly into their computer's operating system, thereby bypassing conventional security controls. As part of
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.