Google on Tuesday said it’s rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled.
ClickFix is a popular social engineering technique in which bad actors trick users into copying and pasting malicious code directly into their computer’s operating system, thereby bypassing conventional security controls.
As part of these attacks, unsuspecting users who land on legitimate-but-compromised sites or click on malicious ads are redirected to phishing landing pages that display fake Cloudflare or Google reCAPTCHA verification or other non-existent errors and instruct users to copy and paste a command on the Windows Run dialog (or the Mac Terminal app) to address it.
The moment a user presses the Enter key after pasting the command, it triggers a multi-stage infection chain that leads to the deployment of malware, such as information stealers or remote access trojans. In an attempt to blend in with regular activity and evade detection, the commands often make use of living-off-the-land (LotL) tools like PowerShell or cmd.exe to download next-stage payloads.
A key reason why ClickFix remains an effective initial access method is that it flips the script on traditional phishing. Instead of exploiting sophisticated vulnerabilities or getting a user to click on suspicious links, it tricks them into opening the front door themselves under the pretext of troubleshooting a commonplace issue.
“By shifting the download process out of the browser and into the terminal, attackers completely sidestep existing Chrome and Safe Browsing download protections,” Google said. “To combat this technique, Chrome now detects when an Enhanced Protection user is tricked into copying suspicious commands.”
If a user copies a potential ClickFix script, the clipboard payload is scrubbed of any personal information it may contain and sent to Safe Browsing for further analysis. If the security system determines the command is dangerous, Chrome displays a warning. By doing so, the idea is to prevent the attack from taking place before the user executes the malicious command.
Separately, Google is also introducing the following defenses in Chrome to tackle web scams for users who enable Enhanced Protection –
- Establishing a taxonomy for Safe Browsing site warnings: Suspicious sites, which exhibit deceptive patterns commonly associated with known malicious sites, and Dangerous sites, which refer to sites that are known to be malicious and have a high risk of user harm.
- Building upon on-device large language model (LLM)-based approaches to flag tech support scams and others, such as fake antivirus and browser update scams.
“This model evaluates page content to analyze key indicators, such as the brand represented, the intent of the page, and a scam likeliness score, giving us rich threat data needed to identify deceptive sites,” Google said.
“Throughout this process, Chrome minimizes the amount of data shared with the server by only analyzing page text when a site exhibits high-confidence scam indicators. And whenever page content is sent off the device, it is processed ephemerally – meaning it is never logged, retained or used to train models.”
On Tuesday, Google said it’s also introducing Financial Services Verification in the U.S. and Canada to validate an advertiser’s credentials and ensure ads come from authorized financial providers. The verification program already applies to various markets globally, including Australia, Brazil, India, Indonesia, Malaysia, New Zealand, Türkiye, and several countries in Europe.
“Under this policy, advertisers must demonstrate they are authorized by relevant regulators or recognized registries before running certain financial ads – helping prevent brand impersonation and stopping bad actors from reaching people,” Google said.
“Alongside our ongoing work with financial regulators, we’re working in the U.S. with the American Bankers Association to use their dedicated registry to verify authorized banks before ads can run. In Canada, we’re engaging closely with the Canadian Bankers Association as we prepare for our rollout.”
Apple Blocks Identity Resolution in Safari and WebKit
The development comes as Apple revealed new privacy protections built into Safari and WebKit that block a practice called identity resolution, which turns email addresses into persistent tracking identifiers. The anti-tracking feature is available as part of iOS, iPadOS, macOS, and visionOS 27 releases.
“In this scheme, third parties (i.e., not the website owner) invisibly collect your email address when you log in or sign up for a newsletter,” Apple’s WebKit team said. “They send the email address to their servers, create an opaque tracking ID permanently linked to your email address, and send that tracking ID back to the web page.”
“The tracking ID is stored on the website and can from thereon be used for arbitrary purposes linked to your email address, such as building a profile of your browsing or targeting ads at you across websites. Logging out or unsubscribing from that newsletter does not remove the tracking ID or your email address stored with the third party.”
Apple said the third parties can build more data about users as they log in with their email address or fill in forms containing personal data, allowing them to create an identity graph with their name, residential address, phone number, and IP address.
To prevent this sort of cross-site tracking, Safari blocks network access to identity resolution infrastructure embedded within the web pages, effectively stopping the third party from sending the email address to their servers. The blocking, Apple said, is done at the domain level.
“It’s not enough to block cross-site cookies to prevent cross-site tracking today because the tracking industry has not stopped trying to track users on the web,” Apple said. “They have ushered into what they call the post cookie era and in our latest releases we have put strong protection in place.”
