Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Chrome Adds ClickFix Warnings Before Users Paste Malicious Commands

Chrome's Enhanced Protection now checks copied commands and warns users before they run ClickFix payloads in Run or Terminal. Here's what changes and what defenders should still do.

4T4Tify Team4Tify
Oct 21, 2026·5 min read
Chrome Adds ClickFix Warnings Before Users Paste Malicious Commands

Chrome Now Warns Users Before They Paste ClickFix Commands

Google is adding a new layer of defense to Chrome aimed squarely at ClickFix, one of the most effective social-engineering tricks of the past two years. Users with Enhanced Protection turned on will now see a warning when a web page tries to get them to copy and run a malicious command.

What happened

ClickFix attacks don't rely on a software flaw. They rely on the victim. A visitor lands on a compromised site or clicks a malicious ad and is shown a fake prompt — a bogus CAPTCHA, a "Cloudflare check", or an invented error. The page quietly places a command on the clipboard and tells the user to paste it into the Windows Run dialog or the macOS Terminal to "fix" the problem.

Once Enter is pressed, a multi-stage infection chain starts, usually ending with an infostealer or a remote access trojan. Attackers lean on built-in tools such as PowerShell and cmd.exe (living-off-the-land) to pull down later stages and blend in with normal activity.

Because the payload is executed by the user outside the browser, it slips past Chrome's usual download protections. Google's answer is to inspect the clipboard instead:

  • When a user with Enhanced Protection copies a likely ClickFix script, the clipboard content is stripped of personal information and checked by Safe Browsing.
  • If the command is judged dangerous, Chrome shows a warning before the user can paste and run it.

Google is also rolling out related changes for Enhanced Protection users:

  • A clearer set of Safe Browsing warnings that separates Suspicious sites (deceptive patterns tied to known malicious sites) from Dangerous sites (known malicious, high risk of harm).
  • Wider use of an on-device language model to spot tech-support scams, fake antivirus pages and fake browser-update lures. Google says page content is only sent to its servers when there are strong scam signals, and is processed ephemerally rather than logged or used for training.
  • A Financial Services Verification program for advertisers, starting in the U.S. and Canada, requiring financial advertisers to prove they are authorized by regulators before their ads run.

In parallel, Apple announced that Safari and WebKit in its upcoming OS 27 releases will block identity resolution, a tracking technique that turns email addresses typed into web forms into persistent cross-site identifiers.

Why it matters

ClickFix works because it turns the user into the delivery mechanism. Email filters, download scanners and many EDR rules see nothing unusual: a person opened a built-in tool and typed a command. Browser-level clipboard checks close one part of that gap. They don't close all of it:

  • The protection only applies when Enhanced Protection is enabled, which is not Chrome's default.
  • Other browsers, and lures delivered outside the browser (chat, documents, email), are not covered.
  • Attackers will adapt their scripts to look benign or split them into steps.

What to do

  1. Turn on Chrome Enhanced Protection across managed devices via policy, not just personal preference.
  2. Train staff on one simple rule: no legitimate website will ever ask you to paste a command into Run, Terminal or PowerShell. Add ClickFix examples to phishing awareness material.
  3. Restrict the Run dialog and script engines for users who don't need them, and enable PowerShell logging and Constrained Language Mode where practical.
  4. Alert on suspicious child processes of explorer.exe launching PowerShell, mshta, or curl with encoded or remote content.
  5. Assume a successful lure means stolen credentials. ClickFix campaigns typically end in infostealers, so rotate passwords and session tokens for any affected user.

That last point is where our team usually comes in: infostealer logs from campaigns like these end up traded on criminal markets, and our Deep/Dark Web monitoring service watches for your organization's credentials and session data appearing there, so you can reset access before it is abused.

Original reporting: The Hacker News.

SHARE