Chrome is adding warnings designed to interrupt scams before users expose systems or data. Enhanced Protection can now detect suspicious copied commands used in ClickFix attacks and send a scrubbed clipboard payload for analysis. Server-side Gemini analysis also evaluates pages showing strong scam signals. Separately, Chrome now asks all users before their first connection to an unencrypted HTTP site.
Why It Matters
ClickFix attacks persuade victims to run commands themselves, moving the malware download outside normal browser protections. The new controls also introduce a lower-confidence suspicious-site warning rather than reserving alerts for confirmed malicious pages. For leaders: browser security settings can reduce risk at a common point of user interaction. For defenders: keep browsers current, consider Enhanced Protection and reinforce that users should not paste website-provided commands into terminals. The larger lesson is that defenses must follow attackers beyond files and links.
What Defenders Should Do
Keep Chrome updated, enable Enhanced Protection where appropriate and train users to reject copied terminal commands from websites.