Google Puts a Guard on the Copy Button
The browser just became a bouncer. Google is teaching Chrome to read the command a scam page tells you to copy, then stop you before you paste it into a terminal you already trust.
What Happened?
Google pushed three changes into Chrome’s Enhanced Protection mode. Pages with deceptive patterns now get a softer suspicious site warning in the address bar, while confirmed malicious pages keep the full page red screen. Scam detection moved from the device to the cloud and now covers fake antivirus and fake browser update lures, scoring page content for brand spoofing and intent alongside domain reputation.
The third change is the interesting one. Copy a suspicious command, and Chrome strips personal data from the clipboard payload, sends it for analysis, and warns you if it’s dangerous. Google says Enhanced Protection users are ten times safer than Standard Protection users, measured by the average number of safety warnings each group sees.
What’s the Impact?
ClickFix works because the download never touches the browser. The person carries the instruction to a command line, where trusted built-in tools do the fetching, and browser download checks have no say. One browser security firm’s telemetry put ClickFix at 67% of its detections in August. The catch: Enhanced Protection is not on by default.
How to Avoid This
- Turn on Enhanced Protection, then verify it stuck
- Teach one rule: no legitimate check asks for a paste
- Log PowerShell script blocks and review RunMRU
- Alert on browsers spawning scripting engines
- Block newly registered domains at egress
IOCs (Indicators of Compromise)
Published ClickFix indicators, grouped by campaign
Every indicator below comes from a named vendor report. Nothing here is inferred or reconstructed. All values are defanged for safe handling.
- The payload is planted in the browser cache ahead of time, disguised as an image, so the pasted instruction can stay short enough for the Run dialog.
- No hashes or IP addresses were published with this one.
- A file plus two words naming convention runs through most of the set, so pattern matching beats the static list.
- Request paths in the shape of /curl/ plus an identifier on the staging hosts.
- The gate fingerprints visitors and serves blanks or decoys to crawlers, sandboxes and virtual machines.
- The source report publishes packed, arm64 and x86_64 Mach-O hashes for each infrastructure set. They are deliberately not reproduced here, because the values could not be verified character for character and a hash that is one character off will silently never match.
- Pull them straight from the Cato CTRL report before loading anything into your tooling.
- Victims arrived through sponsored search results and a free site builder page that loaded attacker content in an iframe.
- Pages gate by URL path and operating system, so a mismatched request may only ever see a harmless decoy.
- RunMRU registry key holding commands nobody remembers typing.
- Scripting engines spawned from a browser or from the Run dialog rather than from an installer.
- PowerShell script block logging switched on, then reviewed for encoded or remotely fetched content.
- New scheduled tasks created shortly after a browsing session.
- Shell sessions started right after browsing that reach straight for download and decoding tools.
- Downloaded content piped directly into a shell instead of being written, inspected and then run.
- Quarantine attributes stripped from a fresh file immediately before it is made executable.
- Keychain, browser credential store, SSH key or wallet access followed by an outbound upload.
- Outbound traffic to newly registered or low reputation hosts within minutes of a page visit.
- The rule for your users: a human check or a repair prompt never asks anyone to paste a command.
Sources: Microsoft Threat Intelligence (Aug 2026 and Oct 2026) and Cato CTRL (Aug 2026). Every value above is reproduced as published. Confirm against the original reports before loading anything into detection tooling, and refang only inside your own controlled environment.
Your Users Will Paste Something Eventually
A pasted command does not look like an attack. It looks like someone doing their job, which is why endpoint tools hesitate and queues fill with maybes that nobody has time to chase down.
Secure.com puts AI Teammates to work above the stack you already own, with your team keeping approvals.
- The Red Teammate runs the same lure against your own people and endpoints inside an approved scope, so you learn what actually lands instead of guessing
- The SOC Teammate picks up the alert, pulls in host, identity, and process context, and assembles the case before an analyst opens it
- Containment pauses at a human gate, so your team approves anything consequential
- Every recommendation, approval, and action is logged, so you can show an auditor who decided what
- Retest after the fix, so the same lure does not work twice