Chrome Will Now Speak Up Before You Paste That ‘Fix’: A Walkthrough of Google’s New Defenses Against ClickFix and Web Scams
Google is adding Chrome warnings that trigger when a user copies a suspicious ClickFix command, along with a new ‘suspicious site’ warning, server-side Gemini scam checks and an HTTP prompt for everyone. Here is what each change does, what employees will see, and the setting most of them need for it to work.
ClickFix attacks succeed because the victim does the risky part. A fake CAPTCHA or error page tells them to copy a command and paste it into the Windows Run box or the Mac Terminal, and pressing Enter starts the infection. Because the download happens in the operating system rather than the browser, the browser’s download protections never get a look at it. Google now says Chrome can step in at the copy stage.
This walkthrough is based on The Hacker News’ report and SecurityWeek’s coverage of Google’s announcement.
First, the condition: Enhanced Protection
Most of the new defenses only apply to users who have turned on Enhanced Protection, the stricter Safe Browsing mode Google introduced in 2020. Google said last year that more than a billion Chrome users had it on, and it claims those users are ten times safer than those on Standard Protection, a figure it bases on how many warnings each group receives on average. If your staff are on the default setting, read the steps below as a list of benefits they are not yet getting.
Step 1: Copying a suspicious command now triggers a check
What changes: When an Enhanced Protection user copies something that looks like a ClickFix script, Chrome strips personal information from the clipboard contents and sends it to Safe Browsing for analysis. If the verdict is dangerous, Chrome shows a warning before the user can paste and run it.
The catch: Google says the system is tuned for high precision so it does not get in developers’ way, which means it will not flag everything. Treat it as a backstop, not a guarantee.
Step 2: Site warnings now come in two levels
What changes: The familiar full-page red warning stays for sites Safe Browsing is highly confident are malicious. A new “suspicious site” level covers lower-confidence cases: pages that use the deceptive tricks common on known malicious sites. It has its own design, which Google says allows it to show these warnings more often.
What employees will notice: A second, different-looking warning. It is worth telling them that both mean stop, not just the red one.
Step 3: Gemini scam detection moves to Google’s servers
What changes: Last year’s on-device scam detection focused on tech support scams and only worked on supported devices. A more capable server-side model is now available to every Enhanced Protection user and also targets fake antivirus and fake browser update pages. It weighs signals such as the brand on display, what the page is trying to get the visitor to do, and a scam-likelihood score, and Safe Browsing combines that with domain reputation for a final verdict.
On privacy: Google says page text is only analyzed when a site shows strong signs of being a scam, and any content that leaves the device is handled ephemerally: not logged, kept or used to train models.
Step 4: Chrome asks before connecting over plain HTTP, for everyone
What changes: Chrome now asks for approval the first time a user visits a site over unencrypted HTTP. This one is on by default for all users, not just Enhanced Protection. Once a site is approved, Chrome will not ask again unless it has gone unvisited for at least two weeks. Single-label hostnames and local IP addresses are exempt by default.
What employees will notice: Probably very little. Google says nearly 95% of desktop users see no HTTP warnings in a given week and fewer than 1% see three or more. If an internal tool or old device web page triggers it regularly, that is a sign it should move to HTTPS.
Step 5 (for the finance team): verified financial ads
Separately, Google is extending Financial Services Verification to the U.S. and Canada. Advertisers will have to show they are authorized by regulators or recognized registries before running certain financial ads, which is meant to cut down on bank impersonation. In the U.S., Google is working with the American Bankers Association’s registry.
Why this is trending
ClickFix has become one of the most common ways attackers get in, and recent campaigns use fake AI tool install pages as bait. One browser security vendor, Push Security, says ClickFix made up an average of 52% of its detections through the second quarter of 2026. A browser that intervenes at the moment of copying is a real change in how this attack is fought.
What this means for your company
These protections only reach employees whose browsers are set up to use them, so check the setting. Enhanced Protection can be turned on in each browser or pushed centrally through your browser management policies, and comparable protections exist in other browsers and security tools. Keep the human rule simple and repeat it: no real website, CAPTCHA or software installer will ever ask you to paste a command into Run, PowerShell or Terminal. Where you can, limit who is able to run PowerShell and command-line tools at all, so a pasted command fails even if someone falls for the page. The browser warning is one layer, the employee’s habit is another, and endpoint controls are a third.
Need help configuring browser protections and endpoint controls so a pasted command cannot turn into a breach? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
