Google Chrome is getting a new security feature designed to stop a dangerous type of attack that tricks people into installing malware themselves. The browser can now detect suspicious commands copied from scam websites and warn users before they run them, adding a layer of protection against ClickFix attacks.
Google announced the changes on October 20 as part of a broader update to Chrome’s Safe Browsing protections. The new command detection works when users have Enhanced Protection enabled.
ClickFix attacks rely on social engineering rather than exploiting a software vulnerability. Attackers may direct users to a compromised website or a malicious advertisement that opens a fake verification page. The page can imitate Cloudflare’s CAPTCHA, Google reCAPTCHA, a browser update, or a system error and tell visitors to follow instructions to fix the problem.
Those instructions may ask users to copy a command and paste it into Windows Run or a terminal. The command can then launch tools such as PowerShell or Command Prompt to download and execute malware, including information stealers and remote access trojans.
The trick is that users believe they are fixing a problem, while they are actually giving the attacker a way to run code on their own computers. Because the malicious activity starts through a command entered by the user rather than a browser download, conventional download warnings may never appear.
Chrome’s new protection attempts to catch the attack before that happens. When an Enhanced Protection user copies a potentially malicious command, Chrome removes personally identifiable information from the clipboard content and sends the remaining payload to Google Safe Browsing for analysis. If the command is identified as dangerous, Chrome displays a warning.
This is a useful change because ClickFix exploits a gap between browser security and user behaviour. Browsers have become better at blocking malicious downloads, but those protections are less effective when a user is persuaded to launch a command through a legitimate system utility.
Google is also expanding Chrome’s scam detection. Enhanced Protection will distinguish between suspicious websites, which show deceptive patterns associated with malicious pages, and dangerous websites, which are known to pose a high risk. The former will receive a less severe warning, while the latter will continue to trigger Chrome’s full-page red warning.
The company is also expanding its use of Gemini to detect scams such as fake antivirus alerts and fraudulent browser update pages. The model examines signals such as the brand represented on a page, its purpose, and how likely it is to be a scam. Google says it combines this analysis with domain reputation and other security signals to make a decision.
There is a privacy consideration here. Google says it only sends page text for server-side analysis when a website shows strong signs of being a scam. It also says the content is processed temporarily, without being logged, retained, or used to train its AI models. For clipboard analysis, Google says it removes personally identifiable information before sending the content to Safe Browsing.
These protections could make ClickFix attacks harder to pull off, but they will not eliminate the technique. Attackers can change their commands, invent new social engineering tricks, or target users who do not have Enhanced Protection enabled. A warning system also cannot guarantee that every malicious command will be detected.
Now that you have read the article until here, you now understand how the attack works. So, never paste a command into your terminal or Windows Run dialog just because a website tells you to complete a CAPTCHA, fix a browser error, or install an update. Legitimate verification pages should not require you to execute system commands.
