Skip to content
NewA calmer, faster ZeroHour
StoryToolsinfo

Chrome warns Enhanced Protection users about ClickFix and scams

4 sources · 4 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Chrome’s Enhanced Protection now uses server-side Gemini scam checks and warns before users run copied ClickFix commands.

Google is rolling out Chrome Safe Browsing changes for Enhanced Protection users that warn on scam pages and on copied commands used in ClickFix attacks. A server-side Gemini model replaces the earlier on-device model and covers fake antivirus, browser-update, and tech-support scams, judging brand, intent, and scam likelihood with domain reputation. ClickFix victims are steered to fake verification or error pages and told to paste commands into Windows Run or Mac Terminal; those commands often invoke PowerShell or cmd.exe to fetch malware. Chrome scrubs personal data from the clipboard payload and sends it to Safe Browsing before the user runs it. Full-page red warnings remain for known dangerous sites, while a lower-confidence “suspicious site” warning covers other deceptive pages.

Key facts
  • Server-side Gemini replaces the earlier on-device scam model for Enhanced Protection.
  • Clipboard text is stripped of personal data before Safe Browsing review.
  • Page text is sent only after high-confidence scam indicators and is not retained.
  • Commands often use PowerShell or cmd.exe to download stealers or remote access trojans.
  • Google says more than one billion users enabled Enhanced Protection.
  • Financial Services Verification is expanding to the United States and Canada.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Help Net SecurityClickFix can show one command while the clipboard holds another.
  • The Hacker NewsPages mimic Cloudflare or reCAPTCHA; victims paste into Run or Terminal.
  • SecurityWeekReports more than one billion Enhanced Protection users.
  • BleepingComputerModel scores brand, intent, and reputation; content is not used for training.
Vendors
GoogleApple
Products
ChromeSafariWebKit
Organizations
American Bankers AssociationCanadian Bankers Association
Countries
United StatesCanada
AI models
Gemini

Coverage

oldest first · one row per article · UTC
  1. · 5d ago Help Net SecurityFirst report

    Chrome warns Enhanced Protection users about ClickFix copy-paste scams

    Server-side Gemini now scores fake antivirus and update pages, and clipboard commands are checked after PII is removed.

  2. · 4d ago The Hacker News

    Chrome warns Enhanced Protection users before they run ClickFix commands

    Copied commands are scrubbed and checked by Safe Browsing, and Chrome is also expanding scam and financial-ad checks.

  3. · 4d ago SecurityWeek

    Chrome warns on ClickFix clipboard commands and plain HTTP

    Server-side Gemini scam checks and ClickFix clipboard warnings are Enhanced Protection features; HTTP prompts are now default for everyone.

  4. · 4d ago BleepingComputer

    Chrome uses Gemini to warn on scam sites and ClickFix commands

    Enhanced Protection now scores pages with a server-side Gemini model and warns before copied ClickFix commands run.