/
← Voltar ao feed
medium

Google adds ClickFix clipboard warnings and Gemini scam detection to Chrome Enhanced Protection; Apple blocks email identity resolution in Safari 27

2 fonte(s) · 2 atualização(ões) · publicado 21/10/2026 10:15 · coletado há 2 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 21/10/2026 12:15; os links antigos trazem para cá.

Fontes: gbhackers.com ↗ thehackernews.com ↗

On October 20, 2026, Google announced new Chrome defenses for users of Safe Browsing Enhanced Protection. They include a warning against ClickFix social engineering, in which suspicious commands copied by the user are scrubbed of personal information and sent to Safe Browsing for analysis (thehackernews.com, gbhackers.com). Google also expanded AI-based scam detection with Gemini for fake antivirus alerts, fraudulent browser updates and tech support scams, and introduced separate "Suspicious" and "Dangerous" warning tiers (thehackernews.com, gbhackers.com). Google also launched Financial Services Verification for advertisers in the U.S. and Canada (thehackernews.com). Separately, Apple announced Safari and WebKit protections in the version 27 releases that block identity resolution infrastructure used to turn email addresses into persistent tracking IDs (thehackernews.com). The protections require Enhanced Protection, and Google's "ten times safer" claim compares average warning counts between protection modes, not a measured tenfold drop in compromises (gbhackers.com).

Timeline

  • 2025 - Google integrated on-device Gemini into Chrome to detect technical support scams on supported devices (gbhackers.com).
  • 2026-10-20 - Google announced the expanded Chrome scam defenses, the ClickFix clipboard protection and the warning tiers (gbhackers.com).
  • 2026-10-21 - Coverage also reports Apple's Safari and WebKit 27 tracking protections and Google's Financial Services Verification for advertisers (thehackernews.com).

Technical Details

  • ClickFix lures users, via compromised legitimate sites or malicious ads, to phishing pages showing fake Cloudflare or Google reCAPTCHA checks or other bogus errors. The pages instruct them to paste a command into the Windows Run dialog or the Mac Terminal (thehackernews.com).
  • Pressing Enter starts a multi-stage chain that deploys information stealers or remote access trojans, often using living-off-the-land tools such as PowerShell and cmd.exe to fetch next-stage payloads (thehackernews.com, gbhackers.com).
  • Moving the download from the browser to the terminal bypasses Chrome and Safe Browsing download protections, which is why the technique remains effective (thehackernews.com, gbhackers.com).
  • Chrome now inspects potentially malicious commands copied during suspected ClickFix activity and strips personally identifiable information before sending the content to Safe Browsing. A dangerous verdict triggers a warning before the user runs the command. The system favors precision to avoid disrupting legitimate developer workflows (thehackernews.com, gbhackers.com).
  • Gemini evaluates the impersonated brand, page intent and a scam likelihood score. Safe Browsing combines this score with domain reputation and other signals for the final verdict, so Gemini adds context and does not decide alone (gbhackers.com, thehackernews.com).
  • Page text is analyzed only on pages with high-confidence scam indicators. Google states the content is ephemeral: not logged, not retained and not used for model training (gbhackers.com, thehackernews.com).
  • "Suspicious" warnings (lower confidence, deceptive patterns) differ in wording, colors, icons and layout from "Dangerous" verdicts. Dangerous verdicts are reserved for known malicious pages and keep the full-page red warning (gbhackers.com).
  • Apple's protection blocks network access to identity resolution infrastructure at the domain level, stopping third parties from exfiltrating email addresses to build identity graphs (thehackernews.com).

Remediation

  • Enable Chrome Enhanced Protection in the Safe Browsing settings to receive the ClickFix clipboard warnings and the new scam detection (thehackernews.com, gbhackers.com).
  • Train users never to paste and run commands from web pages in the Run dialog or Terminal, especially after fake CAPTCHA or error prompts (thehackernews.com, gbhackers.com).
  • Consider restricting PowerShell and cmd.exe execution where feasible (gbhackers.com).
  • Update to iOS, iPadOS, macOS and visionOS 27 for the Safari and WebKit tracking protections (thehackernews.com).

Conflicting Reports

  • Detection architecture: thehackernews.com describes an expanded on-device LLM detection of tech support, fake antivirus and fake browser update scams. gbhackers.com describes a new server-side Gemini model for fake antivirus and fake browser updates, building on the 2025 on-device integration that covered tech support scams. The sources do not reconcile the two descriptions.

Linha do tempo

  1. gbhackers.com ↗ · pub. 21/10/2026 10:20 · coletado 21/10 12:00

    Google Chrome adds server-side Gemini scam detection and ClickFix clipboard protection for Enhanced Protection users

    ler a análise desta fonte

    On October 20, 2026, Google announced an expansion of Chrome's AI-based scam defenses. A new server-side Gemini model detects fake antivirus alerts, fraudulent browser updates and other deceptive sites for users with Safe Browsing Enhanced Protection enabled. It builds on the on-device Gemini integration of 2025, which covered technical support scams on supported devices. Chrome also adds separate warning tiers for suspicious and dangerous sites, and a new defense against ClickFix attacks. Google's "ten times safer" claim compares average warning counts between protection modes, not a measured tenfold drop in successful compromises.

    Technical Details

    • Gemini analyzes page text to identify the impersonated brand, assess intent and produce a scam likelihood score. Safe Browsing combines this score with domain reputation and other signals to reach the final verdict, so Gemini adds context and does not decide alone.
    • Server-side analysis is limited to the text of pages that already show high-confidence scam indicators. Google states that the content is ephemeral: not logged, not retained and not used for model training.
    • Under Enhanced Protection, "suspicious" warnings (lower confidence, deceptive patterns) differ in wording, colors, icons and layout from "dangerous" verdicts. Dangerous verdicts are reserved for known malicious pages and keep the full-page red warning.
    • ClickFix lures trick users into pasting commands that abuse legitimate utilities such as PowerShell and cmd.exe to download or install malware. Running them in a terminal bypasses browser download protections.
    • Chrome now inspects potentially malicious commands copied during suspected ClickFix activity. It strips personally identifiable information from the clipboard content before sending it to Safe Browsing. A dangerous verdict triggers a warning, and the system favors precision to avoid disrupting legitimate developer workflows.

    Remediation

    • Enable Enhanced Protection in Chrome's Safe Browsing settings, since the new protections require it.
    • Train users never to paste and run commands from web pages in a terminal, and consider restricting PowerShell and cmd.exe execution where feasible.
  2. thehackernews.com ↗ · pub. 21/10/2026 10:15 · coletado 21/10 12:00 primeiro registro

    Google adds ClickFix clipboard warnings to Chrome Enhanced Protection; Apple blocks email-based identity resolution in Safari and WebKit

    ler a análise desta fonte

    Google announced new Chrome safeguards against ClickFix social engineering for users with Enhanced Protection enabled. When a user copies a suspicious command, the clipboard content is scrubbed of personal information and sent to Safe Browsing for analysis. Chrome shows a warning if the command is judged dangerous, before the user can run it. Google also introduced a Suspicious/Dangerous taxonomy for Safe Browsing warnings, expanded on-device LLM detection of tech support, fake antivirus and fake browser update scams, and launched Financial Services Verification for advertisers in the U.S. and Canada. Separately, Apple announced Safari and WebKit protections in version 27 releases that block identity resolution infrastructure, which turns email addresses into persistent tracking IDs.

    Technical Details

    • ClickFix lures users, via compromised legitimate sites or malicious ads, to phishing pages showing fake Cloudflare or Google reCAPTCHA checks or other bogus errors. These pages instruct them to paste a command into the Windows Run dialog or the Mac Terminal.
    • Pressing Enter starts a multi-stage infection chain that deploys information stealers or remote access trojans, often using living-off-the-land tools such as PowerShell or cmd.exe to fetch next-stage payloads.
    • Moving the download from the browser to the terminal bypasses existing Chrome and Safe Browsing download protections, which is why the technique remains effective.
    • Google states the on-device LLM evaluates the brand represented, page intent and a scam likeliness score. Page text is analyzed only on high-confidence scam indicators and processed ephemerally.
    • Apple's protection blocks network access to identity resolution infrastructure at the domain level, stopping third parties from exfiltrating email addresses to build identity graphs.

    Remediation

    • Enable Chrome Enhanced Protection to receive the ClickFix clipboard warnings.
    • Train users never to paste commands from web pages into the Run dialog or Terminal, especially after fake CAPTCHA or error prompts.
    • Update to iOS, iPadOS, macOS and visionOS 27 for the Safari and WebKit tracking protections.