Google is rolling out a Chrome defense intended to interrupt ClickFix attacks before users run malicious commands outside the browser. The safeguard is limited to people who have enabled Enhanced Protection, according to Google’s announcement as reported by The Hacker News.
ClickFix relies on persuasion rather than a conventional browser download. A phishing page presents a fake verification step or fabricated error, then tells the victim to copy a command into the Windows Run dialog or macOS Terminal. Executing it can begin a multi-stage infection that installs information-stealing malware or a remote access trojan.
Chrome analyzes suspicious commands copied from web pages
Victims may be sent to ClickFix pages through malicious advertising or redirects from legitimate websites that have been compromised. The pages often imitate Cloudflare or Google reCAPTCHA checks and claim that pasting a supplied command is necessary to continue.
The copied instructions can invoke built-in utilities such as PowerShell or cmd.exe to retrieve later-stage payloads. Because that activity takes place through the operating system rather than Chrome’s normal download process, Google says it can evade the browser’s established Safe Browsing download checks.
Chrome’s new approach moves detection earlier in the sequence. When a user covered by Enhanced Protection copies a potential ClickFix script, Google says Chrome removes personal information from the clipboard content and submits the remaining command to Safe Browsing for assessment. If the service classifies it as dangerous, the browser displays a warning before the user executes it.
The protection does not apply to Chrome users outside Enhanced Protection. It also addresses the copy-and-paste stage rather than making commands safe to run. Users should treat any website instruction to open the Run dialog or Terminal and paste unfamiliar code as a potential compromise attempt.
Scam detection expands beyond copied scripts
Google is also adding two Safe Browsing classifications for Enhanced Protection users:
- Suspicious sites, which display deceptive characteristics associated with known malicious pages.
- Dangerous sites, which are known to be malicious and present a high risk of harm.
The company is extending its on-device large language model work to identify technical-support fraud, fake antivirus warnings and fraudulent browser-update prompts. Google says the model examines the brand a page claims to represent, its apparent purpose and a calculated likelihood that it is a scam.
According to the company, page text is analyzed only after a site exhibits high-confidence scam signals. Google also says any content sent from the device is processed ephemerally rather than logged, retained or used to train its models. These are Google’s descriptions of the system’s operation and data handling.
Safari 27 targets persistent identity resolution
Apple is introducing a separate browser protection in the iOS, iPadOS, macOS and visionOS 27 releases. Its focus is identity resolution, a tracking practice in which a third party receives an email address entered during a login or newsletter registration and associates it with a persistent identifier.
Apple’s WebKit team says the tracking provider can return an opaque ID to the website, where it is stored for later profiling or advertising across sites. The third party may use the email address to construct an identity graph containing additional information, potentially including a name, residential address, telephone number and IP address.
According to Apple, logging out or unsubscribing does not by itself remove either the identifier or the email address retained by the third party. Blocking cross-site cookies is therefore insufficient to stop this form of tracking.
Safari’s countermeasure blocks network connections to embedded identity-resolution infrastructure at the domain level. Apple says this prevents the page from transmitting the email address to the tracking provider in the first place.
For Chrome users, the immediate practical distinction is configuration: ClickFix command analysis is being delivered through Enhanced Protection. Even with that setting active, unexpected instructions to paste commands into operating-system tools should be abandoned rather than executed.
