Chrome Enhanced Protection Tackles Scammers' Copy-Paste Commands
Google is bolstering Chrome's Enhanced Protection mode to identify and flag malicious commands that scammers trick users into copying, enhancing defenses against social engineering attacks.
Google is significantly upgrading Chrome's Enhanced Protection mode to combat a prevalent social engineering tactic: tricking users into copying and executing malicious commands. This update to the Safe Browsing feature aims to neutralize scams where fake "fixes" or "solutions" lead users to inadvertently run harmful code on their systems.
Introduced in 2020, Chrome's Enhanced Protection mode has been progressively refined to shield users from a wide array of online threats. Google reports that these ongoing enhancements have made users ten times safer from phishing, social engineering, notification abuse, and other scams compared to those utilizing the Standard Protection mode. This impressive statistic is derived from comparing the average number of safety warnings presented to users across both protection levels.
The latest enhancements include more tailored warnings for suspicious sites. These alerts are designed with specific formats, icons, colors, and text to help users quickly assess the potential risks and make informed decisions about how to proceed. "By tailoring the warning UI in this way, we are able to safely expand our coverage to display a higher volume of protective warnings," explained Jasika Bawa, Group Product Manager for Chrome.
For sites deemed genuinely dangerous, Chrome will continue to display its full-page red warning screen, indicating a high risk of harm. These warnings are reserved for pages confirmed to be malicious, ensuring users are immediately alerted to severe threats.
A key advancement is the expansion of Chrome's Gemini-powered scam detection. Previously operating on-device, this feature now leverages a server-side model for Enhanced Protection users. It has been updated to detect not only tech support scams but also fake antivirus and browser update scams. The Gemini model analyzes page content for indicators of malicious intent, such as misrepresented brands and deceptive page objectives, combining this with domain reputation and other security signals.
Google emphasizes that page text is only sent for analysis when a site exhibits high-confidence scam indicators. Crucially, this content is processed without being logged, retained, or used for model training, preserving user privacy.
The new warnings specifically target "ClickFix" scams. These deceptive schemes instruct users to "fix" a non-existent problem by copying and pasting a command into their terminal. Attackers often use legitimate system tools, known as living-off-the-land binaries (LOLBins) like PowerShell or cmd.exe, to execute these commands. This allows them to download malware, hide their activities, and bypass security software that trusts these built-in executables. By moving the execution from the browser to the terminal, attackers aim to circumvent Chrome's and Safe Browsing's download protections.
When Enhanced Protection users copy suspicious commands, Chrome now sanitizes the clipboard payload by removing personally identifiable information (PII) before sending it to Safe Browsing for analysis. If the command is identified as dangerous, a warning will be displayed, preventing the execution of potentially harmful code and significantly mitigating the risk posed by these sophisticated social engineering attacks.