Friday, 23 October 2026Global tech news & guides — what changed, and what it means for you.
AuTechWire
Illustration: a stylized browser window under a magnifying lens with an amber warning shield on the address bar; a command-line string dissolving into static before reaching a terminal prompt

Chrome Wants to Catch Scams Before You Paste the Damage Into Your Terminal

by

In brief

  • On October 20, 2026, Google announced three additions to Chrome’s Enhanced Protection mode: a new two-tier site-warning system, server-side Gemini-powered scam detection, and clipboard inspection that warns you when you copy a dangerous ClickFix command.
  • The new “suspicious site” warning covers lower-confidence verdicts — pages that look like scams but do not clear the bar for the full-page red warning. Users get a pop-up reading “This site doesn’t seem right” with a choice to go back or mark the site as safe.
  • Gemini’s scam detection moves from an on-device model (limited to tech support scams on supported hardware) to a server-side model covering fake antivirus and fake browser-update pages for every Enhanced Protection user. Page text is sent to Google’s servers only when high-confidence scam indicators are present, and Google says it is processed ephemerally — never logged, retained, or used to train models.
  • The ClickFix defense targets a scam that surged 517% in six months, according to MakeUseOf: a fake error or CAPTCHA page tricks you into pasting a command into PowerShell, Terminal, or the Windows Run dialog — executing malware outside the browser, past all download protection. Chrome now strips personal data from copied commands, sends them to Safe Browsing, and warns if they are dangerous.
  • The honest caveat: Enhanced Protection is opt-in, not default, and Google’s “ten times safer” claim is based on how many safety warnings users receive — not on how many attacks actually succeeded. These protections also mean more of your browsing signals go to Google’s servers.

What ClickFix is — and why Chrome had to watch the clipboard to stop it

Most browser malware defenses work at the download: Chrome scans files as they come in, blocks known-bad URLs, and flags suspicious installers. ClickFix bypasses all of that by making the victim do the downloading themselves — voluntarily, at the command line.

The anatomy, per ChromeUnboxed’s walkthrough: you visit a compromised or malicious page and see something urgent — a fake system error, a fake browser-update prompt, a CAPTCHA that asks you to “verify you’re human.” The page instructs you to press Windows+R, open PowerShell or Terminal, and paste a command that is conveniently already on your clipboard. Sometimes the command in the clipboard does not even match the text shown on the page.

That command typically invokes a living-off-the-land binary — PowerShell, cmd.exe, mshta — tools that come with the operating system, so there is nothing for antivirus to recognize. It downloads and runs malware while the browser’s download scanner never fires, because no download happened inside the browser. It works on Windows, macOS, and Linux; MakeUseOf specifically warns macOS and Linux users not to assume immunity. The scam has surged 517% in six months, which is why Google is now targeting the exact moment between the command landing on your clipboard and you pasting it into a terminal.

Chrome’s new defense: for Enhanced Protection users, the browser inspects clipboard contents when you copy something that looks like a suspicious command. It scrubs personally identifiable information from the payload, sends it to Safe Browsing in real time, and serves a warning before you paste. The protection only matters if you actually have Enhanced Protection turned on — which is the setting this whole announcement orbits.

Suspicious vs dangerous: what the two warning tiers mean for you

Until now, Chrome’s Safe Browsing site warnings were effectively binary: either the page got the full-page red interstitial (“Dangerous site,” hard to miss, hard to bypass) or you got nothing. That binary forced a conservative threshold — borderline pages slipped through because the nuclear option could not be fired on uncertainty.

The new system splits the verdict. When Safe Browsing is highly confident a page is malicious, you still get the full-page red screen. When the verdict is a lower-confidence “suspicious,” you now get a distinct warning: a pop-up under the address bar reading “This site doesn’t seem right,” explaining the site resembles pages tied to phishing, malware, or scams, with a red “Suspicious” label in the address bar, the page dimmed behind the pop-up, and two options — “Back to safety” or “Mark as safe.”

Two things matter about this design. First, Google says the softer format lets it issue protective warnings more freely — the whole point is volume, since the company can now flag uncertainty without treating every uncertain page as a full block. Second, the “Mark as safe” escape hatch is load-bearing: a lower-confidence verdict will be wrong more often, and legitimate small sites — precisely the kind of indie sites and blogs this publication writes about — are the likeliest false positives. If you run a small site and get flagged, the mechanism for your visitors to override exists, but the damage is in the moment of hesitation.

Gemini moves to the server: what the stronger scam detection actually checks

Chrome already used Gemini to catch tech support scams, but on-device and only on supported hardware — a pilot-scale deployment. The October 20 update moves detection to a more powerful server-side model and widens the net to fake antivirus portals and fake browser-update prompts, available to every Enhanced Protection user regardless of device.

How it works, per Google’s announcement as quoted by BleepingComputer and SecurityWeek: the model evaluates the brand a page claims to represent, the page’s apparent intent, and an overall scam-likelihood score. Safe Browsing then combines Gemini’s analysis with domain reputation and other security signals for a final verdict. In practice, this is the layer that decides whether that “Your Windows license has expired” page you landed on is a scam before the warning tier ever needs to fire.

The privacy mechanics are where the real trade-off lives. On-device detection never left your machine. Server-side detection means page content goes to Google. The company’s stated handling, quoted verbatim across outlets: Chrome only analyzes page text when a site exhibits high-confidence scam indicators, and whenever content is sent off-device it is “processed ephemerally — meaning it is never logged, retained or used to train models.” That is Google’s stated practice, not an independent privacy audit. If you want AI-driven scam detection without server-side page analysis, the old on-device tech-support-scam detection was the closer option — and it is being superseded, not supplemented.

How to turn on Enhanced Protection (and what you are trading for it)

None of these features are on by default. They are part of Enhanced Protection, the highest of Chrome’s three Safe Browsing tiers (the others are Standard Protection and No Protection), introduced in 2020. To enable it: open Chrome’s Settings, go to Privacy and security, open Security, and select Enhanced protection.

Google claims Enhanced Protection makes users “ten times safer” from phishing, social engineering, notification abuse, and other scams than Standard Protection — and last year the company said more than 1 billion Chrome users had turned it on. Read the “ten times” figure with the caveat SecurityWeek flagged: the metric is based on how many safety warnings, on average, each group receives. More warnings per user is not the same as fewer compromised users; it is a proxy, and Google’s. That said, the direction is unambiguous — warnings, especially the new suspicious-tier ones, are the mechanism that interrupts the ClickFix copy-paste moment, and the moment is the whole attack.

The trade you are making: Enhanced Protection already sent more browsing data to Google than Standard Protection (URLs checked against blocklists in real time, a sample of downloads and page content). The October update extends that to Gemini analysis of suspicious pages and clipboard payload inspection. If you bank, work, or handle anything sensitive in Chrome, that is a meaningful widening of what leaves the machine — in exchange for the strongest real-time scam coverage the browser has ever offered.

What this does not fix

No browser protection ends social engineering — Google says as much, and the announcement’s own framing is about warning volume, not prevention guarantees. ClickFix only works because a human pastes the command; Chrome now warns at the paste step, but a sufficiently motivated victim can dismiss any pop-up. The rule that never changes: no legitimate webpage will ever ask you to paste a command into your terminal. If a page does, close it — Enhanced Protection on or off.

And one structural note for the security-minded: attackers have already adapted to every Safe Browsing generation. Clipboard inspection will push ClickFix operators toward page-rendered commands that look less “copiable,” QR-based variants, or clipboard payloads that change between copy and paste. The 517% surge that prompted this defense is evidence of an attack class still growing — expect the counter-move.

Sources

Shoaib Hassan

Shoaib Hassan is the founder and editor of AuTechWire, an independent technology publication covering broadband, mobile networks, privacy, startups, and consumer tech.

Related Stories

Leave a Comment