Google has started rolling out a new wave of security protections for its Chrome browser, targeting two growing threats: ClickFix social engineering attacks and fraudulent websites.
What Is ClickFix?
ClickFix is a social engineering technique in which attackers deceive users into manually copying and pasting malicious code into their operating system. Because the user executes the code themselves, the method sidesteps many conventional security controls that would otherwise block malware delivery. According to The Hacker News, the tactic has become popular among bad actors looking to bypass browser and endpoint defenses.
Chrome's New Defenses
According to The Hacker News, Google is enabling ClickFix warnings for Chrome users who have switched on Enhanced Protection, the browser's highest built-in security tier. When the feature detects that a page is attempting to prompt a user into running a suspicious command, it surfaces a warning before any harm can be done.
Beyond ClickFix, the update also includes broader scam-site detection. According to BleepingComputer, the new capabilities are powered in part by Gemini, Google's AI model, which helps identify pages that exhibit characteristics associated with online scams. Chrome will notify users when they appear to be visiting such a site.
A separate report from The Verge notes that the update also includes a revised HTTPS warning that began rolling out on the same day, adding another layer of communication for users who land on potentially insecure connections.
Context
The rollout reflects a broader industry pattern of browser makers leaning on machine learning to keep pace with fast-evolving web-based threats. Social engineering attacks in particular have grown harder to catch with static rule-based filters, since they exploit human behavior rather than technical vulnerabilities in software. By flagging the moment a page attempts to manipulate a user into running code, Chrome aims to interrupt the attack before the operating system is involved.
Google described the changes in a blog post as part of its ongoing effort to defend against evolving web scams. The protections apply when Enhanced Protection is active, meaning users who rely on the standard or basic protection settings may not receive all of the new warnings.
