Chrome now warns users when a ClickFix lure puts a command on the clipboard, and Google has moved its scam detection from an on-device model to a server-side Gemini model for Enhanced Protection users. The change was announced on 21 October.
What happened
Three things changed inside Safe Browsing. Scam detection for Enhanced Protection users now runs on a more capable server-side Gemini model that weighs the brand shown on a page, the page's apparent intent and how likely it is to be a scam. A new suspicious-site warning covers pages that display deceptive patterns but do not meet the bar for the full red interstitial. And Chrome now inspects clipboard content for ClickFix payloads.
ClickFix needs no software flaw. The page talks the visitor into pasting and running a command themselves, usually in PowerShell or Command Prompt, which drops an infostealer or remote access tool. When Chrome suspects the copied text is a ClickFix script, it strips personally identifiable information and sends what remains to Safe Browsing. If the verdict is dangerous, the user sees a warning before pasting it into a terminal.
Who is affected
The protection is not on for everyone by default, so exposure depends on a browser setting rather than on the threat:
- Windows users on Chrome with Enhanced Protection enabled, the setting that turns the new checks on
- Staff who take instructions by phone, chat or web page and paste whatever they are handed
- Organisations whose users copy commands from support pages, search results or AI chat windows
- Estates still on Standard Protection, where none of this runs
What to do now
Switch Chrome to Enhanced Protection and push the setting through browser policy so it applies to every managed device, then confirm the fleet is on a current Chrome build.
- Set Enhanced Protection under chrome://settings/security, or force SafeBrowsingProtectionLevel=2 through Chrome Enterprise policy
- Keep Chrome updated, because the feature only reaches current builds
- Brief staff that the browser will now warn on pasted commands, and that the warning is not a step to click through
- Search EDR, Sysmon or proxy logs for PowerShell, mshta or curl executions spawned from a browser process in the past month
- Treat anyone who ran a ClickFix command as compromised: reset credentials, revoke sessions and check for new inbox rules
What this means for South African businesses
ClickFix is one of the few techniques that lands on a workstation without a vulnerability, an attachment or a convincing fake login page, which is why it walks past awareness training built around links and attachments. South African SMEs running Chrome on shared Windows desktops get this protection at no cost, but only where Enhanced Protection is on, and in most estates I look at it is still set to Standard. My judgement: push it by policy this week, because the alternative is finding out when the banking details on a supplier invoice quietly change.
Source: BleepingComputer report on the Chrome Safe Browsing changes, 21 October 2026.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.