Google announced Tuesday it's deploying enhanced protections in Chrome to defend users against ClickFix attacks when Enhanced Protection mode is turned on. ClickFix is a widely used social engineering method where attackers deceive victims into copying and running malicious commands straight into their computer's operating system, sidestepping traditional security defenses. The new safeguards represent Google's effort to block a technique that has grown popular because it makes users themselves execute the attack rather than relying on software exploits or suspicious link clicks.
In typical ClickFix attacks, victims who visit legitimate sites that have been compromised or who click on harmful advertisements get sent to phishing pages displaying false Cloudflare or Google reCAPTCHA checks, or other fabricated error messages. These pages tell users to copy and paste a command into the Windows Run dialog box or Mac Terminal application to fix the supposed problem. Once someone hits Enter after pasting the command, it launches a multi-step infection process that ends with malware installation, including information stealers or remote access trojans. The commands frequently rely on living-off-the-land tools like PowerShell or cmd.exe to fetch follow-on payloads, helping attackers blend in with normal system activity and dodge detection.
Chrome's new defense works by detecting when an Enhanced Protection user copies suspicious commands. According to Google, the browser sends the clipboard payload to Safe Browsing for review after scrubbing any personal information it might hold. If the security system concludes the command is harmful, Chrome shows a warning to stop the attack before the user runs the malicious code. Google explained that ClickFix works as an initial access method because it "flips the script on traditional phishing" by tricking people into opening the front door themselves under the guise of fixing a routine issue. The company noted that "by shifting the download process out of the browser and into the terminal, attackers completely sidestep existing Chrome and Safe Browsing download protections."
The ClickFix warnings are part of a broader set of defenses Google is rolling out for Enhanced Protection users to combat web scams. The company is creating a classification system for Safe Browsing site warnings that separates "Suspicious sites"—which show deceptive patterns linked to known malicious sites—from "Dangerous sites," which are confirmed to be malicious and carry high user harm risk. Google is also expanding on-device large language model approaches to identify tech support scams and related schemes like fake antivirus and browser update frauds. The model reviews page content to assess key signals including the brand being represented, the page's intent, and a scam likelihood score. Google emphasized that "throughout this process, Chrome minimizes the amount of data shared with the server by only analyzing page text when a site exhibits high-confidence scam indicators," and that any page content sent off the device "is processed ephemerally—meaning it is never logged, retained or used to train models." Google also announced Tuesday it's launching Financial Services Verification in the U.S. and Canada to confirm advertiser credentials and ensure ads come from authorized financial providers, joining similar programs already operating in Australia, Brazil, India, Indonesia, Malaysia, New Zealand, Turkey, and several European nations. The initiative requires advertisers to prove they're authorized by relevant regulators or recognized registries before running certain financial ads. For organizations navigating the shift from reactive security to preemptive user protection, the real test will be whether warnings interrupt workflow enough to change behavior without training users to dismiss alerts as noise.