Chrome Adds ClickFix Detection, Scam Warnings and HTTP Connection Prompts

Summary

Google added Chrome protections for Enhanced Protection users, including server-side Gemini scam analysis and warnings for suspicious sites and copied ClickFix commands. Chrome also now prompts users before connecting to HTTP sites by default.

Key points

Safe Browsing now distinguishes high-confidence malicious sites from lower-confidence suspicious sites, which receive a separate warning.
Server-side Gemini scam detection is available to all Enhanced Protection users and targets threats including fake antivirus and browser update pages.
Chrome can detect suspicious commands copied by Enhanced Protection users; a potential ClickFix payload is scrubbed of PII and sent to Safe Browsing for analysis.
Chrome now asks for approval before connecting to HTTP sites by default. The prompt appears on the first visit and is suppressed for at least two weeks after approval.
Google says page text is analyzed only when a site shows strong scam indicators, and content sent off-device is handled ephemerally, not logged, stored, or used to train AI models.
Google reports that nearly 95% of desktop Chrome users encounter no HTTP warnings in a given week, while fewer than 1% see three or more.

Article Details

Event Type: Google announced new Chrome security protections against scams, ClickFix attacks, and unencrypted HTTP connections.
Impact: Chrome adds suspicious-site warnings, server-side Gemini scam analysis for Enhanced Protection users, detection of suspicious commands copied in ClickFix attacks, and prompts for approval before connecting to HTTP sites. Google says copied command payloads are scrubbed of personally identifiable information before analysis, and page content sent for scam analysis is handled ephemerally.

MITRE ATT&CK

T1059.001 · PowerShellThe article says ClickFix commands almost always invoke living-off-the-land binaries such as PowerShell.T1204.004 · Malicious Copy and PasteClickFix attacks trick victims into copying and running commands themselves.

Vendors

GoogleGoogle has announced new Chrome protections against scams and social engineering, including new site warnings, server-side Gemini analysis, and detection of ClickFix commands.

Products

GeminiGoogle has announced new Chrome protections against scams and social engineering, including new site warnings, server-side Gemini analysis, and detection of ClickFix commands.Google ChromeGoogle has announced new Chrome protections against scams and social engineering, including new site warnings, server-side Gemini analysis, and detection of ClickFix commands.Safe BrowsingThe Gemini and ClickFix protections are part of Enhanced Protection, the Safe Browsing mode Google introduced in 2020.