Chrome adds ClickFix warnings to block malicious commands
Chrome will analyse suspicious pasted commands and warn Enhanced Protection users before a ClickFix scam can turn a fake fix into malware.
Google is adding a Chrome warning designed to stop users from pasting and running malicious commands as part of a broader set of Safe Browsing protections for people who enable Enhanced Protection. The company says the changes target ClickFix scams, which disguise malware delivery as a fake browser, Cloudflare or CAPTCHA problem.1
ClickFix attacks typically tell someone to copy text from a fraudulent page and paste it into Windows Run or macOS Terminal. The command may use trusted tools such as PowerShell or cmd.exe to fetch and launch a second-stage payload, meaning the victim performs the dangerous action while believing they are fixing a routine error.2
Chrome checks suspicious commands
When a potential ClickFix script is copied, Chrome can scrub personal information from the clipboard payload and send it to Safe Browsing for analysis. If Google's systems judge the command to be dangerous, Chrome displays a warning before the user executes it.1
Google says the protection is aimed at a gap traditional browser download defences cannot close: the malicious download begins only after the user manually moves it into a terminal. The company is also introducing a two-tier warning taxonomy for Enhanced Protection users. Suspicious sites represent a possible risk, while dangerous sites indicate a known malicious site with a high risk of harm.1
The update sits alongside broader scam-detection work using Gemini to examine page content for signals such as the represented brand, the page's intent and its likelihood of being a scam. Google says high-confidence page text may be processed temporarily for this analysis, without being logged, retained or used to train models.1
The Hacker News reports that ClickFix campaigns have already been used to deliver information stealers and remote-access trojans, often by abusing legitimate operating-system utilities.2 The practical lesson is unchanged: a website should never need you to paste a command into Run or Terminal to repair Chrome, a CAPTCHA or a security check.12
Our opinion
This is a useful defensive layer because it targets the moment ClickFix stops being a phishing page and becomes a user-assisted infection. It cannot make a dangerous command harmless, but interrupting the copy-and-paste ritual should give people one more chance to recognise that a fake fix is asking them to hand attackers the keys.