Google Chrome Enhances Security Against ClickFix Attacks

Google announced on October 21 that it is rolling out improved security measures in its Chrome browser to protect users from ClickFix attacks when Enhanced Protection is enabled.

ClickFix is a social engineering tactic where attackers deceive users into copying and pasting malicious code directly into their operating systems, bypassing standard security measures.

During these attacks, users visiting compromised legitimate sites or malicious ads are redirected to phishing pages that display fake verification messages or errors, prompting them to copy and paste commands into the Windows Run dialog or Mac Terminal.

Executing these commands can initiate a multi-stage infection process, deploying malware such as information stealers or remote access trojans. These commands often utilize living-off-the-land (LotL) tools like PowerShell or cmd.exe to download further payloads while evading detection.

ClickFix remains effective because it subverts traditional phishing methods. Instead of exploiting vulnerabilities or tricking users into clicking suspicious links, it misleads them into executing commands under the guise of troubleshooting.

Google stated, “By shifting the download process out of the browser and into the terminal, attackers completely sidestep existing Chrome and Safe Browsing download protections.” To counter this, Chrome will now detect when an Enhanced Protection user is misled into copying suspicious commands.

If a user copies a potential ClickFix script, the clipboard content is analyzed for personal information and sent to Safe Browsing for evaluation. If deemed dangerous, Chrome will issue a warning to prevent the execution of the malicious command.

In addition, Google is implementing further defenses in Chrome for users with Enhanced Protection:

• Creating a taxonomy for Safe Browsing site warnings, categorizing sites as Suspicious or Dangerous based on deceptive patterns.
• Utilizing on-device large language model (LLM) techniques to identify tech support scams, including fake antivirus and browser update scams.

Google explained that this model assesses page content to identify key indicators, such as the brand represented and the likelihood of a scam, providing valuable data to detect deceptive sites.

To minimize data sharing, Chrome analyzes page text only when high-confidence scam indicators are present. Any content sent to the server is processed temporarily, ensuring it is not logged or used for model training.

On the same day, Google introduced Financial Services Verification in the U.S. and Canada to validate advertisers’ credentials, ensuring that ads originate from authorized financial providers. This program is already in place in various global markets.

Under this policy, advertisers must prove they are authorized by relevant regulators before running specific financial ads, helping to prevent brand impersonation and protect users from malicious actors.

Google is collaborating with the American Bankers Association in the U.S. and the Canadian Bankers Association in Canada to verify authorized banks before their ads can be displayed.

In related news, Apple has announced new privacy protections in Safari and WebKit to block identity resolution practices that convert email addresses into persistent tracking identifiers, enhancing user privacy across its platforms.

Source: The Hacker News