Google adds Chrome defense against ClickFix: detects copied commands to clipboard and warns

Google announced Tuesday that it will incorporate new defenses into Chrome to mitigate a social engineering technique known as ClickFix, in which attackers convince victims to paste and run evil commands on the Windows console or MacOS terminal. According to the company, these improvements are activated when the user has enabled the option of Enhanced Protection and aim to detect and block suspicious commands copied to the clipboard before the user presses Enter and triggers the infection chain.

The facts confirmed by Google are these: ClickFix redirects navigators to pages that fend legitimate verifications (e.g., Google's reCAPTCHA or Cloudflare) or show alleged errors, and ask the user to copy and run a command in the Run Windows or Terminal box to "fix" the problem. When executed, these commands often invoke tools of the system itself - PowerShell, cmd.exe or other "living-off-the-land" (LotL) - to download and run later payloads such as remote access Trojans or information thieves. Chrome will now detect potentially dangerous commands copied by users with Enhanced Protection, "clean" personal data from the clipboard content and send the rest to Safe Browsing for analysis; if Safe Browsing determines that it is malicious, it will show a warning to the user.

Technically, ClickFix's effectiveness lies in get out of the protected channel from the browser and bring the download and execution to the context of the operating system. The classic browser defenses (black download lists, HTTP / HTTPS download integrity checks) do not apply if the browser has only served as a vector to instruct the user to manually run something outside the browser download process. The attackers exploit trust and urgency: they ask to copy commands using PowerShell or curl / wget to download a payload from a URL controlled by the attacker, often chained with instructions to run the downloaded binary.

Google's countermeasures are different and different. The function described more specifically is the detection of copied commands to the clipboard and the sending - after removing personal data - to Safe Browsing for an analysis that can result in a warning. Google also adds a taxonomy of warnings (sites "Suspects" vs. "Dangerous") and the use of LLM models on the device to identify pages with high probability of technical scam. The company indicates that when it sends text out of the device it does so in an ephemeral way and without holding it for training, and that the verification protection of financial advertisers will expand in the US. The US and Canada to reduce suplanting in ads.

What is confirmed: Google implements these functions within Chrome and limits them to users with Enhanced Protection; Apple for its part has reported in parallel measurements on Safari / WebKit to block what it calls "identity resolution," a different method of tracking that associates emails with persistent identifiers. What remains in the field of estimation or uncertainty: the actual effectiveness in the field against adapted campaigns, the rate of false positive / negative automatic detection, and to what extent the attackers will change tactic (for example, convert commands into images or ask for complete manual typewriter) to avoid clipboard inspection.

Practical implications: any user who receives instructions from a web, ad or call to run a command on his system is at risk; attackers can reach both consumers and companies. For organizations, ClickFix is attractive because it can mockery traditional navigation controls and target workstations with sufficient privileges to download and run code. The verification of financial advertisers seeks to reduce a channel (malicious ads) used to reach victims, but will not by itself eliminate campaigns that spread through organic means or committed sites.

Specific and verifiable recommendations for readers and administrators: first, Enable Improved Protection in Chrome if you already use that browser - the option is in Settings > Privacy and security > Google Services and Security -; Google documents Safe Browsing and related policies on its developer portal (see developed) and on Chrome's help pages (e.g., Chrome support on improved protection). Second, never paste or run commands in the terminal that come from emerging windows, ads, unverified chats or pages that do not belong to official channels: always confirm the origin by independent channels (official phone, verified corporate site). Third, implement technical controls in managed environments: execution policies, AppLocker or Microsoft Defender Application Control, PowerShell (Constrained Language Mode) restrictions and LotL tool blocking, as well as EDR rules that alert about unusual child processes initiated from browsers or automation tools.

For users concerned about the privacy of the new detection: Google states that it removes personal information from the clipboard and performs ephemeral analysis; even so, if you prefer not to send anything out of the device, the only guarantee is not to activate the enhanced Protection category or review Chrome's privacy settings. Note that disable these protections leaves the user more exposed to ClickFix and other scams based on malicious content.

Finally, do not forget that these mitigations are not definitive: the attackers evolve. It is plausible that after these measures we see an increase in alternate tactics (text images, manual typewriter instructions, direct courier attacks) to avoid automated inspection of the copied content. Effective security combines browser tools, platform controls and, above all, continuous user training so that they don't "open the door" when someone asks.

Useful links to expand and configure protections: Google's Safe Browsing documentation ( developed) and the WebKit / Apple blog on web privacy ( webkit.org / blog), which details initiatives to block follow-up techniques such as identity resolution.