Google has enhanced Chrome protection against ClickFix attacks, in which users are tricked into manually executing malicious commands copied from the clipboard. The update targets scams that impersonate technical support and persuade victims to paste harmful scripts into tools such as PowerShell.
The new mechanisms operate when Enhanced Protection mode in Safe Browsing is enabled. Chrome now recognizes when a suspicious script is copied to the clipboard and can display a warning before the command is executed. The browser sends the command for analysis after stripping personal data; if the check flags it as dangerous, the user receives an alert.
ClickFix attacks rely on a deceptive technique: the site displays a fake error and instructs the user to copy a command, open the system console, and run it. The actual text placed in the clipboard often differs from what is shown on the page, allowing attackers to load malware while bypassing normal download scanning.
In parallel, Google moved detection of fraudulent pages from a local Gemini model to a server-side implementation. The system now searches for fake tech-support pages, counterfeit antivirus software, and bogus browser-update sites. Text sent for analysis is not stored and is not used to train models.
Additional warnings have been introduced for suspicious sites, while known dangerous pages continue to trigger the familiar red interstitial screen.
