Chrome targets scams that trick users into running dangerous commands

Google is adding warnings for suspicious copied commands, fake updates and tech-support lures, giving Chrome users an earlier alert before a full-page danger warning appears.

Chrome is tightening its defences against a growing class of scams that no longer rely on malicious downloads alone. Google is adding warnings for pages that appear to use deceptive patterns associated with fraud, giving users an intermediate alert in the address bar before the browser escalates to the full-page red interstitial reserved for sites already known to be dangerous. The change is aimed at reducing the chance that people are pushed into acting on a fabricated problem before they realise the page is hostile. Chrome’s existing Safe Browsing system already warns about phishing and malware, while Enhanced Protection offers real-time checks for users who opt in.

The most significant addition is support for so-called ClickFix scams, which try to trick people into copying and running commands that allegedly repair an error. According to Google’s update, Chrome now inspects suspicious copied commands with Safe Browsing and warns users when the verdict suggests danger. That matters because these attacks often move execution out of the browser and into built-in tools such as PowerShell or cmd.exe, bypassing the download protections that would normally catch obvious malware delivery. Chrome also checks clipboard activity so it can warn before a user pastes risky code into a terminal.

Google is also broadening the scam detection behind Enhanced Protection with Gemini-based analysis that runs on its servers and is designed to spot fake antivirus prompts, bogus browser update notices and tech-support lures. The company says the system only examines page content when it sees strong indicators of fraud, and that the content is not logged, retained or used to train models. ChromeUnboxed reported that the browser now uses tiered warnings: suspicious sites surface a lighter alert in the address bar, while pages assessed as clearly dangerous still trigger the full red warning screen.

The updates underline how browser security is shifting from simple blocklists towards behaviour-based detection. Instead of only reacting to known malicious domains or file downloads, Chrome is now trying to recognise the social-engineering patterns that persuade users to run the attack themselves. That is a useful change, because many modern scams depend less on technical exploits than on convincing a victim to copy, paste and execute instructions that look legitimate.