Malicious actors exploit fake CAPTCHA tests

Malicious actors can execute harmful commands on computers through fake "I'm not a robot" tests, which trick users into pasting suspicious code into their systems.

Google introduces Chrome defense against ClickFix trap

Google has equipped Chrome with a defense against the ClickFix trap, but users must send more data to its servers to obtain this protection, which involves sharing some clipboard content.

Harmful commands bypass browser protections

The command displayed on the screen is often different from the one hackers place in the clipboard. When users paste it into the Run window in Windows and confirm, PowerShell or cmd.exe are launched, two tools originally installed, allowing malicious software to be downloaded outside the browser.

Opera blocks suspicious commands automatically

Opera has blocked the copying of suspicious commands since July using rules integrated into its browser, offering a built-in security layer without requiring users to send data to external servers.

Google's Enhanced Protection shares clipboard data

Google forwards the task of analyzing suspicious commands to its servers and reserves it for users of Chrome's Enhanced Protection. Activating this mode requires sending part of what is copied to Google for analysis.

Enhanced Protection filters and warns users

If a suspicious command is copied with Enhanced Protection enabled, its content is purged of identifiable personal information and transmitted to Google's Safe Browsing servers. If Google determines the command is dangerous, a warning is displayed in Chrome.

Gemini Nano detects scams on Chrome

Google has moved scam detection by Gemini to its servers. With Gemini Nano, installed in Chrome in 2025, the company detected fake technical support scams on compatible devices, expanding detection to fake antivirus software and browser updates.

Scam detection avoids personal data misuse

Google sends the text of a page to its servers only when there are very strong indications of a scam, and states that this content is "never logged, stored, or used to train models," with personal data removed before sending.

Enhanced Protection collects browsing data

According to Android Authority, Chrome's anti-scam protection has become "better, and more intrusive." Google claims users of Enhanced Protection are ten times better protected against phishing and scams than those with standard protection, based on the number of warnings shown.

Enhanced Protection requires user data

Google receives the addresses of the sites visited and a sample of their content, and now receives the suspicious commands copied. If users never copy commands from web pages, they will gain little from this new feature, which relies on user behavior.

Legitimate commands may trigger false alerts

Users who often copy commands from GitHub or technical documentation may have legitimate PowerShell commands that look like those of hackers and be sent to Google for analysis, which promises to avoid false alerts to developers.

Professional users should consult IT departments

On a professional computer, it is better to consult the IT department about allowing this setting, which involves sharing clipboard data with Google. Users can activate it in Chrome's settings under Privacy and Security, then Security.

Google encourages Enhanced Protection adoption

Google prioritizes its new scam protections for Enhanced Protection and invites internet users to activate it to receive them first, emphasizing the increased security benefits for users who enable the feature.