Google adds ClickFix clipboard warnings and Gemini scam detection to Chrome Enhanced Protection; Apple blocks email identity resolution in Safari 27

Linha do tempo

1. bleepingcomputer.com ↗ · pub. 21/10/2026 19:16 · coletado 21/10 20:00

   Google Chrome adds server-side Gemini scam detection and ClickFix clipboard warnings to Enhanced Protection

   ler a análise desta fonte ocultar

   Google is extending Chrome Enhanced Protection in Safe Browsing with a server-side Gemini model that detects deceptive websites. It also adds warnings when users copy suspicious ClickFix commands. Google claims Enhanced Protection makes users ten times safer from phishing, social engineering, notification abuse and other scams than Standard Protection. Chrome also gains a softer "suspicious site" warning for pages that show deceptive patterns but fall below the confidence threshold for the full-page red warning.

   Technical Details

   • Chrome previously used an on-device Gemini model to detect tech support scams. Enhanced Protection users now get a more powerful server-side model.
   • The model evaluates the brand a page represents, its intent and the likelihood of a scam. Safe Browsing combines this with domain reputation and other signals.
   • Google says page text is analyzed only when high-confidence scam indicators are present. Content sent off-device is processed ephemerally and is never logged, retained or used for model training.
   • For ClickFix, which tricks users into running malicious PowerShell or Command Prompt commands, Chrome strips personally identifiable information from the copied clipboard payload and sends it to Safe Browsing. If the verdict is dangerous, Chrome shows a warning before the user continues.

   Remediation

   • Enable Enhanced Protection in Chrome Safe Browsing settings to receive these detections.
2. securityweek.com ↗ · pub. 21/10/2026 14:00 · coletado 21/10 16:00

   Google adds ClickFix clipboard detection, Gemini scam analysis and default HTTP prompts to Chrome

   ler a análise desta fonte ocultar

   Google announced new Chrome protections against scams and social engineering. They include a two-level Safe Browsing site warning, server-side Gemini scam analysis and detection of ClickFix commands. The Gemini and ClickFix features are part of Enhanced Protection, the Safe Browsing mode introduced in 2020, which Google said last year had more than 1 billion Chrome users enabled. Chrome also now asks for approval before connecting to a site over unencrypted HTTP, and Google has turned this on by default for all users. Google calls Chrome the first browser to take this approach.

   Technical Details

   • Two-level warnings: the full-page red 'dangerous site' warning is kept for high-confidence malicious verdicts. A new 'suspicious site' level covers lower-confidence verdicts for pages using deceptive tactics typical of known malicious sites.
   • Server-side Gemini analysis: it replaces the on-device model launched last year, which focused on tech support scams. It is now available to all Enhanced Protection users and also targets fake antivirus and fake browser update pages. Gemini assesses the brand shown, the page's purpose and a scam likelihood score. Safe Browsing combines this with domain reputation and other signals to reach a final verdict. Page text is analyzed only when a site shows strong signs of being a scam, and Google says it is handled ephemerally and not logged, stored or used for AI training.
   • ClickFix detection: ClickFix lures victims into pasting and running commands themselves, usually through living-off-the-land binaries such as PowerShell. Because the malware download happens in the terminal, Chrome download protections never apply. Chrome now flags a suspicious copied command for Enhanced Protection users. The clipboard payload is scrubbed of PII and sent to Safe Browsing, and Chrome shows a warning if the verdict is dangerous. Google says the system is designed for high precision to avoid disrupting legitimate developer activity.
   • HTTP prompt: shown on the first visit to an HTTP site. After approval, Chrome does not warn again until the user has not visited the site for at least two weeks. Hosts that cannot obtain a publicly trusted certificate, such as single-label hostnames and local IP addresses, do not trigger warnings by default. Early rollout data shows nearly 95% of desktop users see no HTTP warnings in a given week, and under 1% see three or more.

   Remediation

   • Enable Enhanced Protection in Chrome Safe Browsing settings to receive the Gemini and ClickFix protections.
   • Train users never to paste and run commands from web pages into a terminal or Run dialog.
3. zdnet.com ↗ · pub. 21/10/2026 13:43 · coletado 21/10 14:00

   Google adds suspicious-site warnings, expanded Gemini scam detection and ClickFix clipboard defenses to Chrome Enhanced Protection

   ler a análise desta fonte ocultar

   Google has updated Chrome with new scam protections for users running Enhanced Protection mode in Safe Browsing. The browser now distinguishes suspicious sites from known dangerous ones and shows a milder, dismissible warning for the former. Gemini-based detection now also covers fake antivirus and fake browser update scams, beyond the tech support scams covered last year. Chrome can also now detect ClickFix social engineering, in which victims are tricked into copying and running malicious commands themselves.

   Technical Details

   • Suspicious-site warnings are triggered when a page resembles other sites tied to phishing, malware and scams. Gemini analyzes page content, brand, intent and domain reputation to derive a scam likelihood score.
   • Expanded scam detection uses a server-side Gemini model that evaluates page content, domain reputation and other signals. Google says data sent to the back end is minimized, sent only for high scam-signal pages, and is not logged or used for AI training.
   • ClickFix defense: because the victim performs the steps manually, existing Chrome defenses did not catch it. Chrome now inspects copied suspicious commands before they are pasted, wipes personal data from the clipboard, and warns the user if the activity is judged dangerous.

   Remediation

   • Enable Enhanced Protection in Chrome (Settings > Privacy and security > Security on desktop, or Safe Browsing on mobile).
   • Also enable Enhanced Safe Browsing in the Google account under Security & sign-in.
4. gbhackers.com ↗ · pub. 21/10/2026 10:20 · coletado 21/10 12:00

   Google Chrome adds server-side Gemini scam detection and ClickFix clipboard protection for Enhanced Protection users

   ler a análise desta fonte ocultar

   On October 20, 2026, Google announced an expansion of Chrome's AI-based scam defenses. A new server-side Gemini model detects fake antivirus alerts, fraudulent browser updates and other deceptive sites for users with Safe Browsing Enhanced Protection enabled. It builds on the on-device Gemini integration of 2025, which covered technical support scams on supported devices. Chrome also adds separate warning tiers for suspicious and dangerous sites, and a new defense against ClickFix attacks. Google's "ten times safer" claim compares average warning counts between protection modes, not a measured tenfold drop in successful compromises.

   Technical Details

   • Gemini analyzes page text to identify the impersonated brand, assess intent and produce a scam likelihood score. Safe Browsing combines this score with domain reputation and other signals to reach the final verdict, so Gemini adds context and does not decide alone.
   • Server-side analysis is limited to the text of pages that already show high-confidence scam indicators. Google states that the content is ephemeral: not logged, not retained and not used for model training.
   • Under Enhanced Protection, "suspicious" warnings (lower confidence, deceptive patterns) differ in wording, colors, icons and layout from "dangerous" verdicts. Dangerous verdicts are reserved for known malicious pages and keep the full-page red warning.
   • ClickFix lures trick users into pasting commands that abuse legitimate utilities such as PowerShell and cmd.exe to download or install malware. Running them in a terminal bypasses browser download protections.
   • Chrome now inspects potentially malicious commands copied during suspected ClickFix activity. It strips personally identifiable information from the clipboard content before sending it to Safe Browsing. A dangerous verdict triggers a warning, and the system favors precision to avoid disrupting legitimate developer workflows.

   Remediation

   • Enable Enhanced Protection in Chrome's Safe Browsing settings, since the new protections require it.
   • Train users never to paste and run commands from web pages in a terminal, and consider restricting PowerShell and cmd.exe execution where feasible.
5. thehackernews.com ↗ · pub. 21/10/2026 10:15 · coletado 21/10 12:00 primeiro registro

   Google adds ClickFix clipboard warnings to Chrome Enhanced Protection; Apple blocks email-based identity resolution in Safari and WebKit

   ler a análise desta fonte ocultar

   Google announced new Chrome safeguards against ClickFix social engineering for users with Enhanced Protection enabled. When a user copies a suspicious command, the clipboard content is scrubbed of personal information and sent to Safe Browsing for analysis. Chrome shows a warning if the command is judged dangerous, before the user can run it. Google also introduced a Suspicious/Dangerous taxonomy for Safe Browsing warnings, expanded on-device LLM detection of tech support, fake antivirus and fake browser update scams, and launched Financial Services Verification for advertisers in the U.S. and Canada. Separately, Apple announced Safari and WebKit protections in version 27 releases that block identity resolution infrastructure, which turns email addresses into persistent tracking IDs.

   Technical Details

   • ClickFix lures users, via compromised legitimate sites or malicious ads, to phishing pages showing fake Cloudflare or Google reCAPTCHA checks or other bogus errors. These pages instruct them to paste a command into the Windows Run dialog or the Mac Terminal.
   • Pressing Enter starts a multi-stage infection chain that deploys information stealers or remote access trojans, often using living-off-the-land tools such as PowerShell or cmd.exe to fetch next-stage payloads.
   • Moving the download from the browser to the terminal bypasses existing Chrome and Safe Browsing download protections, which is why the technique remains effective.
   • Google states the on-device LLM evaluates the brand represented, page intent and a scam likeliness score. Page text is analyzed only on high-confidence scam indicators and processed ephemerally.
   • Apple's protection blocks network access to identity resolution infrastructure at the domain level, stopping third parties from exfiltrating email addresses to build identity graphs.

   Remediation

   • Enable Chrome Enhanced Protection to receive the ClickFix clipboard warnings.
   • Train users never to paste commands from web pages into the Run dialog or Terminal, especially after fake CAPTCHA or error prompts.
   • Update to iOS, iPadOS, macOS and visionOS 27 for the Safari and WebKit tracking protections.