Google announced new scam defences for Chrome today, including a check for ClickFix commands (Google). It’s good news, and it’s been a long time coming. Proofpoint first saw ClickFix in March 2024 (Proofpoint). In the two and a half years since, it has become one of the most common ways attackers get malware onto business computers, and every layer that catches it helps.
If you look after a business’s computers, it’s worth knowing exactly what the new checks do, how to turn them on for everyone, and where they stop.
What Google added
All three are part of Safe Browsing’s Enhanced Protection mode:
- ClickFix detection. When a user copies what looks like a ClickFix command, Chrome removes personal details from the text, sends it to Google Safe Browsing to check, and shows a warning if it’s dangerous.
- Scam pages checked by Gemini. When a page shows strong signs of a scam, such as a fake tech support page, fake antivirus or a fake browser update, Chrome sends its text to Google, where Gemini judges it. Google says the content is never logged, kept or used to train models.
- “Suspicious site” warnings. A gentler warning than the red full-page one, for sites that look deceptive but where Google is less certain. This lets Chrome warn about many more sites.
Google says people using Enhanced Protection are ten times safer from phishing and scams than with Standard Protection. Read Google’s announcement for the details.
Turn it on for your whole organisation
Standard Protection is Chrome’s default, so these checks only reach users who switch Enhanced Protection on themselves. You can switch it on for everyone with one Chrome policy, SafeBrowsingProtectionLevel set to 2 (Chrome Enterprise). Set as a mandatory policy, users can’t turn it back down.
- Group Policy: Google Chrome, Safe Browsing settings, Safe Browsing Protection Level, set to Enhanced protection.
- Intune: in a settings catalog profile, Google Chrome, Safe Browsing settings, Safe Browsing Protection Level.
- Google Admin: in the Chrome browser settings, under Security, Safe Browsing protection.
Enhanced Protection shares more browsing information with Google than Standard Protection, to check sites and downloads in real time. Check that fits your organisation’s privacy policy and your obligations to staff before turning it on.
What it doesn’t cover
- It’s Chrome only. Microsoft Edge doesn’t use Google Safe Browsing. It uses Microsoft Defender SmartScreen instead, so these checks don’t reach it. Many Microsoft 365 businesses use Edge, and plenty use both.
- It’s a warning, and the user decides. Google’s post says Chrome shows a warning when a copied command is judged dangerous. It doesn’t say the command is taken off the clipboard. A user who has been told to “verify they’re human” may well carry on.
- It checks what users copy. Most ClickFix pages put the command on the clipboard themselves, through a button or a script. Google’s post only describes text users copy.
- IT doesn’t hear about it. The warnings are for the person at the keyboard. Google’s post doesn’t describe any report to the business.
- The rules aren’t yours. Google decides what counts as dangerous. You can’t block something outright for some staff, or allow it for IT.
- Text leaves the computer to be checked. It’s scrubbed of personal details first, but some organisations, and some of their clients, won’t want clipboard content or page text sent to a third party.
Why has it taken so long?
ClickFix has been around since March 2024, and one of the most common attacks for most of that time. So why is a check only arriving now, and only for people who switch it on?
Google hasn’t said, so we can only point to what makes it hard for a browser maker:
- A browser is built for everyone. Developers and IT staff copy and run commands all day. A check that got in their way, across billions of users, would do real harm, so a browser maker has to be very sure before it warns.
- The clipboard is private. Checking what someone copies means reading it. Google sends the text to its servers, with personal details removed, and only for people who have chosen Enhanced Protection.
- The commands keep changing. Attackers rewrite them to slip past fixed rules, so Google judges them on its servers, with what it sees across the web.
Those difficulties are real, but they’ve been known for two and a half years, and businesses have been paying for ClickFix the whole time. Security works when everyone plays their part: browser makers, email and hosting providers, IT teams and the people at the keyboard. The browser is where ClickFix happens, so a check there has been a long time coming. We’re glad it’s here.
A business still shouldn’t wait for browser makers to catch up. It knows what its staff need. A receptionist never needs a website to put a PowerShell command on the clipboard, so that can simply be blocked, today, in both browsers.
How Browser Rules fits alongside it
Browser Rules is an extension for Chrome and Edge, managed from one admin console. Against ClickFix, it does the parts the new Chrome check doesn’t:
- It works the same in Chrome and Edge.
- It checks what the page puts on the clipboard, whether through a Copy button or a script, against a list of the commands attackers use. A match never reaches the clipboard. Safe text goes there instead, so pasting it into the Run box does nothing.
- It’s on by default, from the moment the extension is installed.
- Users’ own copies can be covered too, with a warning or a block, from the Rule Library.
- The check happens inside the browser. Clipboard text isn’t sent anywhere to be checked.
- IT sees it. Each block is recorded in the audit log, with the website and the policy.
- The rules are yours. Your message, your contact details, and different rules for different groups of staff.
How it works in detail is in How to stop ClickFix attacks in Chrome and Edge.
Use both
They don’t compete. Chrome’s new checks are free and catch scams Google sees across the whole web. Browser Rules blocks the ClickFix step outright, in both browsers, with your rules and a record for IT. Together with endpoint protection on the computer, that’s three layers an attacker has to get past.
If your organisation is happy to share the browsing information Enhanced Protection needs, turn it on by policy, and run Browser Rules alongside it. Browser Rules is free for up to 50 users.