Chrome Now Warns Users When They Copy Suspicious ClickFix Commands

Google has announced improved protections in its Chrome browser against ClickFix attacks, available to users who have Enhanced Protection switched on. ClickFix is a social engineering technique where attackers trick people into copying and pasting malicious commands into their own computer, which bypasses many conventional security controls.

These attacks typically start when a user lands on a legitimate but compromised website, or a malicious ad. They are then redirected to a fake page showing a bogus Cloudflare or Google reCAPTCHA check, or another made-up error. The page tells them to paste a command into the Windows Run dialog or the Mac Terminal app. Once the user presses Enter, a multi-stage infection can begin, leading to malware such as information stealers or remote access trojans. The commands often use built-in tools like PowerShell or cmd.exe to blend in with normal activity.

Google says attackers move the download out of the browser and into the terminal, sidestepping existing Chrome and Safe Browsing download protections. Chrome now detects when an Enhanced Protection user copies a suspicious command. The clipboard content is scrubbed of personal information and sent to Safe Browsing for analysis. If it is judged dangerous, Chrome shows a warning before the user can run it. Google also says it is adding other scam defences for Enhanced Protection users.