Google Chrome Adds Click Fix Warnings to Stop Users From Running Malicious Commands
Summary: Google said on Tuesday that Chrome is rolling out improved safeguards against ClickFix attacks for users with Enhanced Protection enabled, detecting when a user is tricked into copying a suspicious command and sending the scrubbed clipboard payload to Safe Browsing for analysis. ClickFix lures users on compromised sites or via malicious ads to fake Cloudflare or reCAPTCHA pages that instruct them to paste commands into the Windows Run dialog or Mac Terminal, triggering an infection chain that often uses living-off-the-land tools like PowerShell or cmd.exe to download next-stage payloads such as information stealers or remote access trojans.
What's compelling: ClickFix works precisely because it moves the download out of the browser and into the terminal, sidestepping the Chrome and Safe Browsing download protections you already rely on - the user opens the front door themselves under the pretext of fixing a routine error.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026