Chrome is about to check what you just copied

The scam Google is aiming at goes like this. A page tells you something is broken, or that you need to prove you are human, and hands you three steps: press Windows and R, press Ctrl and V, press Enter. You have just pasted a command you never read, and the malware arrives through the terminal instead of through the browser. Google put the problem plainly in its announcement on 20 October: "By shifting the download process out of the browser and into the terminal, attackers completely sidestep existing Chrome and Safe Browsing download protections."

The new defence closes that gap at the one point where the browser can still see what is happening, which is the clipboard. When Chrome spots what looks like a ClickFix script being copied, it strips personal information out of the payload, sends it to Safe Browsing for a verdict, and shows a warning before anything runs. Google says the check is tuned for high precision so it does not pester developers copying ordinary commands, and that the content is processed ephemerally, "never logged, retained or used to train models".

Two other changes landed alongside it. Chrome's warnings now come in two strengths, a softer one for suspicious sites and the familiar red page for dangerous ones. And the Gemini-based detection that flags fake antivirus alerts, fake browser updates and tech support scams has moved from a small on-device model to a server-side one for everybody in Enhanced Protection. Google's figure for that mode is that it leaves users ten times safer than Standard Protection.

None of it applies unless you turn it on. Chrome Settings, then Privacy and security, then Security, then Enhanced protection. The underlying rule has not changed and will not: no genuine error message asks you to paste anything into the Run box, which is our whole ClickFix guide in one sentence. If something did get pasted at some point, Tendvane's Safety check lists the unwanted programs and remote-access tools now sitting on your PC.