Chrome Adds Warnings for ClickFix and Suspicious Sites

Google is adding Chrome warnings for deceptive websites and commands used in ClickFix scams, according to BleepingComputer. The protections matter at home because ClickFix pages try to persuade people to run malicious commands themselves, bypassing the browser’s normal download checks.

What happened

Chrome’s Safe Browsing system now has a “suspicious site” warning for pages that resemble known malicious sites but do not meet the confidence level required for its full-page red danger screen. This gives Chrome a way to warn about more potentially deceptive pages without labeling every one as confirmed malware.

Google has also moved its Gemini-based scam analysis from supported devices to its servers. According to SecurityWeek, the expanded system can examine signs such as the brand shown on a page, the page’s apparent purpose and the likelihood that it is a scam. It is intended to catch threats including fake antivirus alerts, bogus browser updates and tech-support scams.

The Gemini analysis and ClickFix detection are available through Chrome’s Enhanced Protection mode. Google says page text is sent for analysis only when a site already shows strong scam signals. That content is processed temporarily and is not logged, retained or used to train its AI models, according to both reports.

ClickFix scams commonly tell victims to copy a command and paste it into PowerShell, Command Prompt or another terminal. Because the command runs outside the browser, ordinary download scanning may never see the resulting malware. Chrome can now analyze a suspicious copied command after removing personally identifiable information and display a warning if Safe Browsing judges it dangerous.

Chrome is separately asking users for approval before visiting ordinary unencrypted HTTP sites. SecurityWeek reports that this prompt is now enabled by default for everyone, although local addresses and sites that cannot obtain publicly trusted HTTPS certificates are excluded by default.

Who is affected

Anyone using Chrome may encounter the new suspicious-site and HTTP connection warnings. The server-based Gemini checks and copied-command detection specifically apply to people who use Enhanced Protection in Safe Browsing.

Google has not disclosed a specific Chrome version for these protections in the provided reports. It also has not said that every suspicious page or command will be detected, so users should not treat the absence of a warning as proof that a site is safe.

What to do now

1. Open Chrome’s Safe Browsing settings and check whether Enhanced Protection is selected. This is the mode that includes the Gemini scam analysis and ClickFix command checks described by Google.

2. Stop when Chrome labels a page suspicious or dangerous. Close the tab instead of entering a password, payment information or personal details.

3. Never paste a command into PowerShell, Command Prompt or a terminal because a website says it is needed to fix an error, prove you are human or install an update. ClickFix attacks depend on convincing the victim to perform this step.

4. Treat fake antivirus and browser-update pages as scams. Leave the page and obtain updates through Chrome or the software maker’s normal controls, not through a website’s pop-up.

5. If Chrome asks for permission to open an HTTP site, check the address carefully before continuing. An HTTP connection is not encrypted, and Google says the older “Not Secure” label could appear only after the connection and data were already exposed.