Phishing

Chrome now warns about copied ClickFix commands

By Yaali. October 22, 2026, 6 min read, Phishing, Windows.

Chrome's Enhanced Protection now checks copied commands for ClickFix lures. What the warning covers, what it misses, and the Windows and Mac controls to add.

Google said on October 20, 2026 that Chrome now looks out for ClickFix, the trick where a web page talks a visitor into pasting a command into the Windows Run dialog, PowerShell or the Mac Terminal. When a user with Enhanced Protection copies what looks like a ClickFix script, Chrome removes personal information from the clipboard text, sends it to Google Safe Browsing for a verdict, and shows a warning if the verdict is dangerous. Google says the check is built for high precision, so developers copying ordinary commands should not be interrupted.

The check only runs for people who have Enhanced Protection switched on, and that is not Chrome's default. Google has not said which Chrome versions or operating systems get it, when the rollout finishes, what the warning says, or whether a user can click past it. Treat it as one more layer: the Run dialog, PowerShell and Terminal on your endpoints still need their own controls.

How ClickFix works

ClickFix needs no software vulnerability. A compromised site, a malicious ad or a phishing page shows a fake Cloudflare or Google reCAPTCHA check, or an invented error. When the visitor clicks, JavaScript on the page writes a command to the clipboard, and the page then tells them to press Win+R or open Terminal, paste and press Enter. The visitor runs the attacker's command with their own rights.

On Windows the command is usually a one-liner that hands off to tools already on the machine: PowerShell, cmd.exe, mshta.exe (which runs HTML Application files), msiexec or curl, often with an encoded or obfuscated string. It fetches the next stage, typically an information stealer or a remote access trojan. On macOS, Jamf has documented Atomic Stealer (AMOS) campaigns where the pasted command is an obfuscated curl pipeline into zsh that decodes a base64 and gzip payload, then downloads a binary to /tmp and runs it.

Google's own explanation for the new check is that ClickFix moves the download out of the browser and into the terminal, which sidesteps Chrome's download protections. The browser never saves a file, so there is nothing for a download scan to look at. The one moment the command still passes through Chrome is when it lands on the clipboard, and that is where the new check sits.

What attackers are doing now

ClickFix keeps changing shape to get around the controls built against it. In early October, Microsoft Threat Intelligence described a campaign that loads a VBScript into the browser cache disguised as a PNG image, so the pasted Run command only has to find and launch a file already on disk; we covered it in ClickFix hides its payload in the browser cache. In August Microsoft reported TerminalFix, which asks for Windows Terminal or PowerShell instead of the Run dialog and ends with Active Directory reconnaissance and a reverse tunnel (our write-up).

Apple added its own check in macOS Tahoe 26.4. Some pasted commands in Terminal are blocked with the message "Possible malware, Paste blocked. Your Mac has not been harmed." Apple has not documented the feature, and users report that it does not flag everything. Attackers already have a route around it: in April 2026 Malwarebytes reported a fake "reclaim disk space" lure that uses the applescript:// URL scheme to open Script Editor with a script already filled in, and Jamf has described the same technique. Nothing is pasted into Terminal in that chain.

What Chrome's check does not cover

From what Google has published, the check depends on two things: the victim copies the command inside Chrome, and that copy belongs to a user on Enhanced Protection. Everyone on Standard Protection is outside it, and so is anyone using Edge, Firefox or Safari for the same browsing.

Lures that never put the command on the clipboard in Chrome are also outside it. That includes the Script Editor route above, a command copied from a PDF, chat app or email client, and one the victim types by hand after a "support" caller reads it out. Google tuned the check for precision, which normally means some unfamiliar commands get through rather than ordinary ones being flagged. And it is a warning at copy time: once a command has run, the browser has no part in cleaning up.

What to do

Enforce Enhanced Protection. Set the Chrome policy SafeBrowsingProtectionLevel to 2. In Group Policy it is Computer Configuration, Administrative Templates, Google, Google Chrome, Safe Browsing Settings, "Safe Browsing Protection Level"; the registry value lives under HKLM\Software\Policies\Google\Chrome. Confirm it applied at chrome://policy. Enhanced mode sends more browsing data to Google than Standard, so clear it with whoever owns privacy first.
Remove the Run dialog for staff who never use it. The setting "Remove Run menu from Start Menu" sits under User Configuration, Administrative Templates, Start Menu and Taskbar and writes NoRun under Software\Microsoft\Windows\CurrentVersion\Policies\Explorer. In Intune, search the Settings catalog for the same name, or use the ADMX-backed CSP ./User/Vendor/MSFT/Policy/Config/ADMX_StartMenu/NoRun. It disables Win+R and removes the New Task (Run) command from Task Manager. Microsoft is clear that it "doesn't prevent users from using other methods to run programs", so a lure that asks for PowerShell still works.
Constrain PowerShell. PowerShell switches to Constrained Language Mode on its own when an AppLocker or App Control for Business (formerly WDAC) policy is enforced. In that mode Add-Type cannot compile arbitrary C# or call Win32 APIs, and only an allowlist of .NET types is usable, which breaks many loader one-liners. Microsoft says to pair it with App Control in System Lockdown mode so it cannot be bypassed. Check a session with $ExecutionContext.SessionState.LanguageMode. The same policy can block mshta.exe where nothing uses it.
Alert on what the paste starts. Commands typed into Run start as children of explorer.exe and are recorded in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU; Elastic's ClickFix rule pairs those two signals. Terminal-based variants typically start under WindowsTerminal.exe and leave no RunMRU entry. In Microsoft Defender for Endpoint advanced hunting:

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("explorer.exe", "WindowsTerminal.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe", "msiexec.exe", "curl.exe")
| where ProcessCommandLine has_any ("-enc", "FromBase64String", "iex", "http", "hidden")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Expect some noise from administrators and tune it with an exclusion list rather than dropping the rule. On Macs, keep devices on macOS 26.4 or later and add an EDR alert for Script Editor or osascript starting curl or zsh.

Teach one sentence. No real CAPTCHA, error page or update prompt asks you to press Win+R, open Terminal or PowerShell, and paste something. The sequence Win+R, Ctrl+V, Enter on instructions from a website is the warning sign; close the tab and report it.

If someone has already pasted a command, isolate the machine, read its RunMRU entries and process tree to see what ran, and assume the payload was a stealer: reset passwords saved in that user's browsers and revoke their active sessions for cloud and SaaS accounts.

Our safeguarding and hardening reviews check whether NoRun, App Control and Chrome policies are actually applied across a fleet, and security operations can run the hunts above for you. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: Google: Our latest defenses against evolving web scams, The Hacker News, Chrome Unboxed, XenoSpectrum, MakeUseOf, Help Net Security on the macOS Terminal warning, Malwarebytes on the macOS Terminal warning, Malwarebytes on the Script Editor lure, Jamf Threat Labs, Microsoft Learn: ADMX_StartMenu policy CSP, Microsoft TechNet: Remove Run menu from Start Menu, Microsoft Learn: about_Language_Modes, Google Chrome support: Safe Browsing protection levels, DISA STIG V-221580 for Chrome, Elastic: Potential ClickFix Command via Windows Run Dialog, Infosecurity Magazine on cache smuggling.