Chrome now spots the booby-trapped commands fake sites trick you into copying
Google is adding a warning against "ClickFix" scams to Chrome and handing the analysis of suspicious pages to a Gemini model. These protections are limited to Enhanced Protection mode, which you have to turn on yourself.
Automated publication. This article was written by artificial intelligence, then checked by a second AI model that verifies the facts against primary sources. It was published without prior human review.
Translated from French by AI. The original French article is the reference version.
The page looks like a routine verification. To continue, it asks you to copy a command, then paste and run it yourself on your computer. This is how so-called "ClickFix" scams work. They get around browser protections because it is the victim, not the website, who launches the malware.
On October 20, Google announced that Chrome can now recognize this trap, but only for users of Safe Browsing's "Enhanced Protection" mode. When one of them copies a suspicious command, Chrome strips personal information from the copied content, sends it to its analysis service and displays a warning if the verdict is dangerous. Google says it designed the check to rarely trigger by mistake, so as not to bother developers, who copy commands all day long.
A Gemini model to judge dubious pages
Until now, Chrome used a Gemini model running locally on some devices to spot fake tech support pages. It is moving to a more powerful model, run on Google's servers and extended to all Enhanced Protection users. This model examines the brand a page claims to represent, its intent and the likelihood that it is a scam. It also targets fake antivirus software and fake browser updates.
What about privacy? According to Google, a page's text is sent only if it shows signs of a scam deemed highly reliable. This content would be processed ephemerally, without being logged, stored or used to train models. These guarantees have not been independently verified.
An intermediate warning for suspicious sites
Chrome is adding a second level of alert. Sites judged dangerous with high confidence keep the full-screen red page. Sites that are merely suspicious get a more discreet warning, with a different design. Google explains that this distinction lets it warn users more often without multiplying false alarms. The company also claims that Enhanced Protection makes its users "ten times safer." However, the calculation is based on the average number of warnings displayed, which measures exposure more than protection.
How to take advantage of it, and the habits that still matter
Google does not specify the rollout schedule, or which countries or platforms are concerned. To turn the mode on, go to Chrome's settings, under "Privacy and security," then "Security," and choose "Enhanced protection." In return, this mode shares more browsing data with Google: it is up to each user to weigh that choice.
- Never paste a command offered by a website into a "Run" window, a terminal or PowerShell, whatever the pretext.
- A genuine "I'm not a robot" check never asks you to type or paste anything outside the browser.
- In companies, limit the use of PowerShell and administration tools to the workstations that need them, and make teams aware of this scenario.
Google is thus continuing the approach it started on Android, where Gemini can analyze your SMS exchanges with strangers. It remains to be seen whether Enhanced Protection, which requires users to opt in, will eventually be turned on by default.
Method: article written by artificial intelligence from public sources, facts verified by a second, independent AI model, published automatically without prior human review, under the editorial responsibility of Frédéric LENQUETTE. Spotted an error? Let us know. Our editorial policy.
Share this article
