Chrome Now Checks Your Clipboard Before ClickFix Scams Can Bite
Chrome's Enhanced Protection now checks copied commands for ClickFix scams, uses server-side Gemini to spot scam pages, and adds a softer suspicious-site warning.
Google is adding three scam defenses to Chrome’s Enhanced Protection mode, BleepingComputer reports. The most interesting one watches for ClickFix: when you copy a command that looks malicious, Chrome sends it for a check and can warn you before you paste it. Chrome is also moving its Gemini scam detection from your device to Google’s servers, and it’s adding a milder “suspicious site” warning for pages that don’t earn the full red screen. Google announced the changes in an Oct. 20 blog post.
For defenders
Scope: All three features apply only to Chrome users with Safe Browsing Enhanced Protection. Standard Protection users get none of them. Google gave no Chrome version number, rollout date or platform list.
ClickFix check: ClickFix pages trick users into pasting a “fix” into PowerShell or cmd.exe. That’s T1204.004 (User Execution: Malicious Copy and Paste), usually followed by T1059.001 (Command and Scripting Interpreter: PowerShell) or T1059.003 (Command and Scripting Interpreter: Windows Command Shell). Google points out that the payload is fetched outside the browser, so Chrome’s download protections never see it. Now Chrome checks the copy itself: it strips personal data from the clipboard, sends the rest to Safe Browsing, and shows a warning if the verdict is dangerous. Google says the check is tuned for high precision so developers copying real commands aren’t flooded with prompts. Treat it as one extra layer. Endpoint controls on PowerShell, the Run dialog and LOLBin execution still matter, and other browsers don’t have this check.
Gemini detection: The earlier on-device model only covered tech support scams on supported hardware. The new server-side model scores a page’s brand, its intent and how likely it is to be a scam, and covers fake antivirus and fake browser updates too. Google says page text leaves the device only when strong scam signals are already present, and it’s “never logged, retained or used to train models.”
Suspicious-site tier: Lower-confidence verdicts now get their own warning design, separate from the red full-page “dangerous” block, much like Chrome’s download warnings already work.
What it means for you
ClickFix is the fake “prove you’re human” box or “fix this error” pop-up that tells you to press a few keys and paste something. Doing that runs a program on your computer that the scammer chose. Chrome can now catch some of those commands, but only if you’ve turned on Enhanced Protection, which is off by default. A real website never needs you to paste a command to prove you’re human.
Do this now
- Turn on Enhanced Protection in Chrome: Settings, then Privacy and security, then Security. Google’s instructions cover each platform.
- Turn on Enhanced Safe Browsing for your Google Account as well.
- If any page tells you to press Windows+R, open PowerShell or paste a command, close the tab. No warning from Chrome doesn’t mean it’s safe.
- Managing a fleet? You can enforce Enhanced Protection through Chrome policy, but keep your PowerShell and script controls in place anyway.