What Google is changing in Chrome
Google said on Tuesday that it is rolling out improved safeguards in Chrome against ClickFix attacks for users who have Enhanced Protection turned on, according to The Hacker News.
If a user copies a command that may be a ClickFix script, Chrome removes any personal information from the clipboard contents and sends the payload to Safe Browsing for analysis. If the system decides the command is dangerous, Chrome shows a warning. The goal, the report said, is to stop an attack before the user runs the malicious command.
How ClickFix attacks work
ClickFix is a social engineering technique that persuades people to copy and paste malicious code into their computer's operating system, which lets attackers sidestep conventional security controls. Victims typically land on legitimate but compromised sites or on malicious ads, then get redirected to phishing pages showing fake Cloudflare or Google reCAPTCHA checks or other made-up errors.
The pages tell users to paste a command into the Windows Run dialog or the Mac Terminal app. Once the user presses Enter, a multi-stage infection chain can begin, leading to malware such as information stealers or remote access trojans. The commands often rely on living-off-the-land tools like PowerShell or cmd.exe to fetch later payloads and blend in with normal activity.
The technique remains effective, according to the report, because it reverses traditional phishing: rather than exploiting sophisticated vulnerabilities or getting someone to click a suspicious link, it gets the user to open the door under the pretext of fixing a common problem. Google said that moving the download from the browser into the terminal lets attackers "completely sidestep existing Chrome and Safe Browsing download protections."
Other scam defenses from Google
For Enhanced Protection users, Google is also creating a taxonomy for Safe Browsing site warnings. Suspicious sites show deceptive patterns commonly associated with known malicious sites, while Dangerous sites are known to be malicious and carry a high risk of user harm.
Google is also building on on-device large language model approaches to flag tech support scams, fake antivirus offers and fake browser update scams. The company said the model weighs indicators such as the brand represented, the intent of the page and a scam likeliness score. Google said Chrome analyzes page text only when a site shows high-confidence scam indicators, and that content sent off the device is processed ephemerally, meaning it is "never logged, retained or used to train models."
Separately, Google is introducing Financial Services Verification in the U.S. and Canada. Advertisers must show they are authorized by relevant regulators or recognized registries before running certain financial ads. In the U.S., Google said it is working with the American Bankers Association and its registry to verify authorized banks, while in Canada it is engaging with the Canadian Bankers Association ahead of a rollout. The program already applies in markets including Australia, Brazil, India and several European countries.
Apple's anti-tracking move in Safari
The report notes the news comes as Apple described new privacy protections in Safari and WebKit that block identity resolution, a practice that turns email addresses into persistent tracking identifiers. The feature is part of the iOS, iPadOS, macOS and visionOS 27 releases.
Apple's WebKit team said third parties can invisibly collect an email address at login or newsletter signup, send it to their servers, and return an opaque tracking ID linked to it. Logging out or unsubscribing does not remove that ID, Apple said. Safari now blocks network access to identity resolution infrastructure embedded in pages, and Apple said the blocking is done at the domain level.
