Chrome: ClickFix warnings and Gemini analysis of scam sites

Google has announced new Chrome defences against scams and social engineering. The most relevant one for anyone managing company workstations concerns ClickFix: Chrome can now notice when a user copies a malicious command from a web page and show a warning before it is run. The changes, reported by Help Net Security, The Hacker News, SecurityWeek and BleepingComputer, mostly apply to Safe Browsing’s Enhanced Protection mode; the HTTP connection check applies to everyone.

What has changed

The sources describe four changes:

1. Two levels of site warnings. The full-page red warning remains for sites Safe Browsing considers dangerous with high confidence. A new «suspicious site» level covers less certain verdicts: pages using deceptive patterns typical of known malicious sites. According to SecurityWeek, this mirrors the two-level model already used for downloads. Google explains that a dedicated design lets it show more warnings without causing too much disruption.
2. Server-side scam analysis with Gemini. The on-device model, which only looked for tech support scams, has been replaced by a server-side model available to all Enhanced Protection users. It now also recognises fake antivirus and fake browser update pages. It assesses the brand displayed, the purpose of the page and the likelihood of a scam; Safe Browsing combines this with domain reputation and other signals.
3. Warnings on copied ClickFix commands (details in the next section).
4. Confirmation before HTTP connections. According to SecurityWeek, Chrome now asks all users for permission before opening a site over unencrypted HTTP, a feature that reached Enhanced Protection users earlier this year.

How the ClickFix check works

In ClickFix attacks a page invents a problem (a CAPTCHA to pass, an error to «fix») and asks the victim to copy a command and paste it into a terminal or the Run dialog. Help Net Security points out that the copied command can differ from the one shown on screen. It usually launches tools already present on the system, such as PowerShell and cmd.exe, which download and install the malware.

The weakness being exploited is specific: the download goes through the terminal, not the browser, so Chrome and Safe Browsing download protections never come into play. Google has therefore moved the check to the moment of copying. When an Enhanced Protection user copies text that looks like a ClickFix script, Chrome strips personal data from the clipboard content, sends it to Safe Browsing and, if the verdict is «dangerous», shows a warning. Google says it aimed for high precision, so as not to disrupt legitimate developer work.

The sources do not give a Chrome version, a rollout timeline or the operating systems involved; BleepingComputer refers to PowerShell and Command Prompt commands, i.e. Windows. The sources do not make clear whether users can dismiss the warning: BleepingComputer writes that it appears «before you continue».

MITRE ATT&CK techniques

The check targets these techniques:

• User Execution: Malicious Copy and Paste (T1204.004), the command pasted by the victim;
• Command and Scripting Interpreter: PowerShell (T1059.001) and Windows Command Shell (T1059.003);
• Ingress Tool Transfer (T1105), the malware download performed from the terminal rather than the browser.

Data sent to Google

Google states that page text is analysed on its servers only when a site shows strong signs of being a scam, and that the content sent is processed ephemerally: it is not logged, retained or used to train models. For the clipboard, personal data is removed before sending. For a European company, this is still work content leaving the device: the decision to enable Enhanced Protection on all workstations should also be assessed with whoever handles data protection.

Impact for European and Italian businesses

ClickFix does not exploit a vulnerability: it exploits the user, who runs the command with their own permissions. A browser warning at the moment of copying adds a layer of defence, but it only covers Chrome with Enhanced Protection enabled. Other browsers, and commands arriving by other routes such as email, chat or documents, remain uncovered.

Google’s claim that users are «ten times safer» than with Standard Protection is based on the average number of warnings shown to the two groups: it measures how many warnings appear, not how many attacks succeed.

The HTTP check also affects internal applications. According to Google it does not trigger for single-label hostnames and local IP addresses; going by this description, internal applications reached over HTTP with a fully qualified domain name should instead show the confirmation prompt on the first visit, and again after at least two weeks without visits.

For entities in scope of NIS2, basic cyber hygiene and staff training are part of the required risk management measures. In healthcare, where workstations are used to access portals holding patient data, a single pasted command can lead to the theft of the credentials for those portals.

What to do now

1. Evaluate Enhanced Protection on managed workstations: Chrome enterprise policies let you set the Safe Browsing level (SafeBrowsingProtectionLevel). Involve your data protection officer regarding content sent to Google.
2. Inventory internal applications served over HTTP and move them to HTTPS, or tell users about the new confirmation prompt.
3. Do not rely on the browser alone: restrict PowerShell and script interpreters for users who do not need them, consider disabling the Run dialog via Group Policy and enable PowerShell script block logging.
4. Hunt for traces: powershell.exe or cmd.exe processes launched by explorer.exe with download commands, outbound connections right after, recent entries in the RunMRU registry key.
5. Inform staff: no legitimate verification asks you to copy and run a command. Anyone who sees a Chrome warning about a copied command should stop and alert IT.

How ARXDOME helps

ARX Sentry collects logs and security events from computers and servers and groups them into families such as suspicious executions, with MITRE ATT&CK tactics shown in the SOC pages: an executed ClickFix command leaves traces even when the browser did not stop it. With ARX Trace, analysts run searches across multiple machines, for example on PowerShell executions, and ARX Shield lets you isolate a suspicious computer from the network.

Last updated: 21 October 2026