Chrome Warns Users About ClickFix Traps

Google is adding Chrome warnings to help stop ClickFix scams, where criminals persuade people to copy and run harmful commands under the guise of fixing a routine browser or verification problem. The scams commonly use fake Cloudflare or Google reCAPTCHA pages, then direct victims to paste a command into Windows Run or Mac Terminal, which can install malware.

Key findings

• ClickFix attackers use compromised websites or malicious advertisements to send victims to phishing pages.
• The phishing pages impersonate verification services or display fake errors, then tell users to copy and paste a command into Windows Run or Mac Terminal.
• Executing the pasted command can begin a multi-stage malware infection, including information stealers or remote-access trojans.
• Attackers often use legitimate system tools such as PowerShell and cmd.exe to download later-stage malware.
• Chrome Enhanced Protection can analyze suspicious copied commands and warn users before they execute them.

Who’s being targeted

• Commonly targeted roles: All employees, Remote workers, Administrative staff, Help desk personnel, Users with access to sensitive business systems.
• Affected industries: All industries.
• Attack channels: website.
• Impersonated: Cloudflare or Google reCAPTCHA.

Awareness takeaways

• Never copy and run commands from a website to solve a CAPTCHA, browser error, security alert, or verification request.
• Treat requests to open Windows Run, Terminal, PowerShell, or cmd.exe as a major warning sign when they originate from a web page.
• Use browser security protections where available, but do not rely on them as the only defense against suspicious instructions.

Red flags to watch for

• A verification or error page asks you to open Windows Run or Terminal.
• A website asks you to copy, paste, and run a command.
• The page claims a normal browser verification requires troubleshooting actions outside the browser.