Google has announced new security improvements for Chrome designed to protect users from ClickFix attacks, a social engineering technique that attempts to trick people into manually executing malicious commands on their devices. The new safeguards are being introduced for users who enable Enhanced Protection in Chrome, strengthening defenses against a growing attack method that bypasses traditional browser security controls. ClickFix campaigns typically rely on fake verification pages, misleading error messages, or fraudulent instructions that convince users to copy and paste commands into system tools such as Windows Run or Mac Terminal. Google said the new protection aims to identify suspicious commands before they are executed and reduce the risk of malware infections caused by these techniques.
ClickFix attacks usually begin when users visit legitimate websites that have been compromised or encounter malicious advertisements that redirect them to deceptive pages. These pages may imitate services such as Cloudflare or Google reCAPTCHA verification screens and display fake technical issues that encourage users to follow instructions. Instead of exploiting software vulnerabilities directly, attackers rely on user interaction by convincing victims that copying a command will solve a problem. Once a user runs the command, it can trigger a multi-stage infection process that may install information stealing malware or remote access tools. Attackers often use legitimate system utilities such as PowerShell or command prompt tools to download additional payloads while attempting to avoid detection. Google explained that ClickFix remains effective because it changes the traditional phishing approach by moving the malicious execution process outside the browser environment. Instead of relying only on suspicious downloads or links, attackers persuade users to perform actions themselves. Under the new Chrome protection, when an Enhanced Protection user copies a potentially harmful command, the clipboard content is analyzed through Safe Browsing systems. Google stated that personal information contained in copied content is removed before analysis. If the command is identified as dangerous, Chrome displays a warning to prevent users from executing it.
Alongside ClickFix protection, Google is also expanding Chrome security features with additional Safe Browsing improvements. The company is introducing a classification system for website warnings, separating suspicious websites with deceptive patterns from dangerous websites known to create significant risks for users. Google is also expanding the use of on device large language models to identify scams such as fake technical support services, fake antivirus alerts, and fraudulent browser update pages. The company said its AI based models analyze webpage content, including brand references, page intent, and scam indicators, while limiting the amount of information shared externally. Google stated that webpage content sent for analysis is processed temporarily and is not stored or used for model training. Google has also announced Financial Services Verification expansion in the United States and Canada to help prevent fraudulent financial advertisements. Under this system, advertisers promoting certain financial services must verify their authorization through recognized regulators or official registries before running ads. Google said the initiative is designed to reduce brand impersonation and prevent unauthorized providers from reaching users through financial advertisements.
Meanwhile, Apple has introduced additional privacy protections in Safari and WebKit through iOS, iPadOS, macOS, and visionOS 27 updates. The company is addressing identity resolution techniques that allow third parties to convert email addresses into persistent tracking identifiers. Apple explained that some third parties collect email addresses during account creation or newsletter subscriptions and use them to create tracking profiles connected across websites. To counter this practice, Safari now blocks network access to identity resolution infrastructure embedded in webpages, preventing third parties from transferring email addresses to their own servers for tracking purposes. Apple said blocking cross site cookies alone is no longer sufficient because tracking methods have continued evolving beyond traditional cookie based approaches. The latest browser updates from Google and Apple reflect the growing focus on protecting users from both cybersecurity threats and privacy risks as online tracking methods and social engineering techniques continue to develop.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
