Google Chrome Adds ClickFix Attack Protection, Apple Blocks Cross-Site Identity Tracking

Google has announced new security safeguards for Chrome designed to protect users against ClickFix attacks when Enhanced Protection is enabled. The company is also expanding its defenses against deceptive websites and scams, while introducing additional verification requirements for financial advertisements in the United States and Canada.

ClickFix is a social engineering technique that tricks users into executing malicious commands on their own devices. Rather than exploiting a software vulnerability, attackers manipulate victims into copying and pasting commands under the pretext of fixing a browser error, completing a verification check, or resolving a technical issue.

Chrome Detects Suspicious Commands Used in ClickFix Attacks

ClickFix campaigns commonly direct victims to malicious websites or compromised legitimate sites through phishing links and deceptive advertisements. The landing pages may display fake Cloudflare verification screens, fraudulent Google reCAPTCHA prompts, or fabricated browser errors.

Victims are then instructed to copy a command into the Windows Run dialog or macOS Terminal. Once executed, the command can initiate a multi-stage infection chain that downloads and deploys malware, including information stealers and remote access trojans.

Attackers frequently abuse legitimate system utilities such as PowerShell and Command Prompt to retrieve additional payloads while attempting to blend malicious activity into normal system operations.

Google said Chrome's new protection detects suspicious commands when users with Enhanced Protection enabled are tricked into copying them. When a user copies a potentially malicious script, Chrome analyzes the clipboard content through Safe Browsing. If the command is identified as dangerous, the browser displays a warning before the user executes it.

This approach aims to interrupt the attack before the malicious command runs, addressing a technique that can bypass conventional browser download protections by moving the execution process outside the browser.

Google Expands Protection Against Deceptive Websites

Google is also introducing clearer categories for Safe Browsing website warnings.

The updated classification distinguishes between suspicious websites that display deceptive patterns associated with malicious activity and dangerous websites that are known to pose a high risk to users.

Additionally, Chrome is expanding its use of on-device large language models to identify technical support scams, fake antivirus alerts, and fraudulent browser update prompts.

According to Google, the model evaluates page content using indicators such as the brand represented, the page's apparent purpose, and a score estimating the likelihood of a scam.

Google said it limits the amount of information shared with its servers by analyzing page text only when a website exhibits strong scam indicators. Any page content sent off the device is processed temporarily and is not logged, retained, or used to train models.

The safeguards are intended to help identify deceptive websites while limiting unnecessary exposure of users' browsing data.

Google Introduces Financial Services Advertiser Verification

Separately, Google is introducing Financial Services Verification in the United States and Canada to help confirm that advertisers promoting certain financial products are authorized providers.

Under the policy, advertisers must demonstrate authorization from relevant regulators or recognized registries before running covered financial advertisements. The goal is to reduce financial brand impersonation and prevent fraudulent advertisers from reaching potential victims.

Google is also working with the American Bankers Association in the United States and the Canadian Bankers Association in Canada to support verification of authorized financial institutions.

Similar verification requirements already apply in several other markets, including India, Australia, Brazil, Indonesia, Malaysia, New Zealand, and Türkiye.

Apple Blocks Identity Resolution Tracking in Safari and WebKit

The announcement comes as Apple introduces new privacy protections in Safari and WebKit across its iOS, iPadOS, macOS, and visionOS 27 releases.

The protections target a practice known as identity resolution, in which third parties collect users' email addresses during login or newsletter registration and convert them into persistent tracking identifiers.

These identifiers can be stored on websites and used to connect browsing activity with a person's email address. Over time, third parties may combine this information with names, residential addresses, phone numbers, and IP addresses to build detailed identity profiles.

Apple said that logging out or unsubscribing does not necessarily remove identifiers already created by these tracking systems.

To counter this practice, Safari blocks network access to identity-resolution infrastructure embedded in webpages at the domain level. This prevents the affected third parties from transmitting collected email addresses to their servers through the blocked infrastructure.

Apple emphasized that blocking cross-site cookies alone is no longer sufficient to prevent online tracking, as tracking companies have developed alternative methods to identify users across websites.

What These Changes Mean for Users

Google's Chrome safeguards aim to prevent users from executing malicious commands through deceptive verification prompts and fake technical support messages. Users should still avoid copying commands from unfamiliar websites or following instructions that ask them to run scripts to verify their identity or fix unexpected browser errors.

Enabling Chrome's Enhanced Protection provides access to the additional safeguards described by Google. Users should also keep their browsers updated and remain cautious when interacting with suspicious advertisements, verification pages, and software update notifications.

Meanwhile, Apple's identity-resolution protections add another layer of privacy defense by restricting certain forms of email-based tracking across websites.

Together, these developments reflect an ongoing effort to address evolving online threats, including social engineering attacks that exploit user trust and tracking techniques that attempt to link browsing activity to real-world identities.