Google is expanding Chrome’s scam protection to identify deceptive websites and warn people before they run commands copied from a ClickFix attack.
What Chrome is changing
Chrome’s Enhanced Protection mode is gaining a new suspicious-site warning for pages that show common scam patterns, even when the evidence has not reached the threshold for the browser’s existing full-page red warning.
Google is also moving scam analysis for Enhanced Protection users to a more capable server-side Gemini model. The system combines page signals with domain reputation and other Safe Browsing information. Google says page text is only sent when strong scam indicators are present, is processed temporarily, and is not retained or used to train models.
Protection against ClickFix
A ClickFix page typically claims that something is broken, asks the visitor to copy a “fix”, and then tells them to paste it into PowerShell, Command Prompt, or the Windows Run box. The command can download malware, steal browser sessions, or provide remote access.
Chrome’s new protection can analyse a suspicious copied command after removing personally identifiable information. If Safe Browsing identifies it as dangerous, the browser warns the user before they continue.
What businesses should do
- Keep Chrome updated. Browser security improvements only help once the current release reaches the device.
- Review Safe Browsing policy. Enhanced Protection provides the new server-assisted checks, but its data-handling trade-offs should be assessed before organisation-wide deployment.
- Train staff on the key warning sign. A website should not require someone to open PowerShell or paste a command to prove they are human, fix a browser, or view a document.
- Control script execution. Application control, least privilege, endpoint protection, and PowerShell logging provide important layers when a user is deceived.
- Report suspicious prompts. Users should close the page and contact IT rather than trying the proposed command.
Our advice
The browser warning is useful, but it is not a replacement for staff awareness and endpoint controls. Treat any unexpected instruction to paste a command into Windows as a security incident until it has been checked by a trusted technician.
