"By shifting the download process out of the browser and into the terminal, attackers completely sidestep existing Chrome and Safe Browsing download protections," Google said.
Chrome's ClickFix detection for Enhanced Protection
Google announced a targeted countermeasure in Chrome for users who enable Enhanced Protection: the browser now detects when a user is being guided to paste a suspicious command into a system terminal as part of a ClickFix social‑engineering attack. ClickFix scams typically redirect victims—after they land on a legitimate‑but‑compromised page or a malicious advertisement—to phishing landing pages that show fake Cloudflare or Google reCAPTCHA screens (or other fabricated errors) and instruct the user to run a command in the Windows Run dialog or the macOS Terminal.
When the pasted command is executed, Chrome's notice explains, it often triggers a multi‑stage infection chain that deploys malware such as "information stealers or remote access trojans." The commands frequently use living‑off‑the‑land (LotL) tools like PowerShell or cmd.exe to download next‑stage payloads, a tactic attackers use to blend with normal system activity and evade detection.
How Chrome scrubs the clipboard and uses Safe Browsing
Under the new behavior, if an Enhanced Protection user copies a potential ClickFix script, Chrome scrubs the clipboard payload of any personal information and sends that content to Safe Browsing for analysis. If the security system determines the command is dangerous, Chrome displays a warning—intended to stop the attack before the user presses Enter and the chain executes.
Google is also formalizing the way it warns users by establishing a Safe Browsing taxonomy for site warnings: "Suspicious sites, which exhibit deceptive patterns commonly associated with known malicious sites, and Dangerous sites, which refer to sites that are known to be malicious and have a high risk of user harm." The taxonomy is intended to give clearer signals to users about the degree of threat posed by a page.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleOn‑device LLM models to flag tech‑support and scam pages
Chrome will build on "on‑device large language model (LLM)‑based approaches" to identify tech‑support scams and other deceptive pages such as fake antivirus and browser update scams. Google described the model as one that "evaluates page content to analyze key indicators, such as the brand represented, the intent of the page, and a scam likeliness score, giving us rich threat data needed to identify deceptive sites."
To limit telemetry exposure, Google said Chrome minimizes the amount of data sent to servers by only analyzing page text when a site exhibits high‑confidence scam indicators. And "whenever page content is sent off the device, it is processed ephemerally – meaning it is never logged, retained or used to train models."
Financial Services Verification for ads in the U.S., Canada and other markets
Separately, Google is rolling out Financial Services Verification in the U.S. and Canada to validate advertiser credentials and ensure certain financial ads come from authorized providers. The program already applies to markets including Australia, Brazil, India, Indonesia, Malaysia, New Zealand, Türkiye, and several countries in Europe. Under the policy, advertisers must demonstrate authorization by relevant regulators or recognized registries before running certain financial ads, a measure Google says will help prevent brand impersonation and stop bad actors from reaching people.
Google added it is working with the American Bankers Association to use that group's dedicated registry to verify authorized banks in the U.S., and is "engaging closely with the Canadian Bankers Association" in preparation for the Canadian rollout.
Apple blocks 'identity resolution' in Safari and WebKit in OS 27 releases
Complementing the browser‑level defenses from Google, Apple disclosed privacy protections in Safari and WebKit across iOS, iPadOS, macOS, and visionOS 27 that block a practice Apple calls identity resolution. Apple described the scheme: "third‑parties (i.e., not the website owner) invisibly collect your email address when you log in or sign up for a newsletter," then send it to servers to create a persistent tracking ID linked to the email.
That tracking ID, Apple said, can be stored on a website and used to build profiles and target ads across sites; logging out or unsubscribing does not remove the ID. To stop the practice, Apple will "block network access to identity resolution infrastructure embedded within the web pages," performing the blocking at the domain level.
What this means for security teams, end users, and financial advertisers
- Security teams and technologists: Chrome's clipboard analysis and Safe Browsing taxonomy give security operators clearer signals and a pre‑execution choke point for commands that previously bypassed browser protections by moving execution into terminals.
- End users: Those who enable Enhanced Protection gain an explicit defense against ClickFix flows—the clipboard is scanned and suspicious commands will trigger warnings—while Apple’s domain‑level blocks limit a cross‑site tracking method tied to email addresses.
- Financial advertisers and banks: Advertisers for financial services will need to demonstrate regulator or registry authorization in markets covered by Google's verification program; Google is coordinating with the American Bankers Association and the Canadian Bankers Association for U.S. and Canadian verifications, respectively.
Taken together, Google and Apple are moving defenses closer to where two different threat patterns begin—Google against prompt‑driven terminal exploits and Apple against an email‑based tracking technique. Both approaches shift responsibility to platform controls: Chrome will warn Enhanced Protection users before a pasted command runs, while Safari and WebKit will stop identity resolution at the network/domain layer. Whether these platform‑level interventions will materially reduce the success rate of ClickFix lures or of persistent cross‑site tracking will depend on attacker adaptation and on the reach of the protections (for example, users who opt into Enhanced Protection and markets covered by ad verification).
