Chrome expands Gemini scam detection and adds ClickFix warnings

Google is expanding scam protections in Chrome’s Enhanced Protection mode, adding Gemini analysis of deceptive websites and warnings for suspicious commands associated with ClickFix attacks.

Chrome previously used an on-device Gemini model to detect tech support scams. For Enhanced Protection users, it is moving to a more powerful server-side model. Google says the model assesses signals including the brand shown on a page, the page’s intent and the likelihood it is a scam. Safe Browsing combines that analysis with domain reputation and other security signals.

Google says Chrome analyzes page text only when a site shows high-confidence scam indicators. When page content is sent off the device, the company says it is processed ephemerally: it is not logged, retained or used to train models.

Enhanced Protection can also detect when a user copies a suspicious command from a ClickFix scam, which can trick people into running malicious PowerShell or Command Prompt commands themselves. If Chrome suspects a ClickFix script, it removes personally identifiable information from the clipboard payload and sends it to Safe Browsing for analysis. If the command is found to be dangerous, Chrome displays a warning before the user continues.

Chrome is also introducing a “suspicious site” warning for pages that show deceptive patterns but do not meet the confidence threshold for its existing full-page red warning. Google says the tailored warning allows Chrome to show protective alerts on more pages.

Google claims Enhanced Protection makes users ten times safer from phishing, social engineering, notification abuse and other scams than Standard Protection.