Google Adds Chrome Warnings to Counter ClickFix Paste-and-Run Lures

En bref

• ClickFix operators use copy-paste lures to get Chrome users to run harmful commands.
• Google began rolling out in-browser warnings on Tuesday.
• The approach can get around an existing security control.
• Turning on Enhanced Protection is the recommended user-side mitigation.

Google has started surfacing warnings in Chrome as of Tuesday, targeting a social-engineering pattern known as ClickFix. Rather than relying on a software vulnerability, these campaigns persuade people to copy text from a web page and paste it into a place where the operating system will execute it. No CVE is associated with this activity.

The lure is simple: a page or prompt tells the visitor that pasting a supplied string will fix an issue or complete a check. If the person complies, harmful commands can run under their account. That outcome can also get around a security control that would otherwise stop direct execution. The affected population is broad: anyone using Chrome could encounter the prompt.

Google's response is a warning layer in Chrome, rolled out starting Tuesday. The company is also pointing users toward Enhanced Protection, a stronger browsing mode. The severity is medium because exploitation depends on user action, but the consequences can be serious on endpoints with weak execution controls.

For K-12 and government environments, the risk is not a zero-day but user behavior at scale. Staff and students who routinely paste troubleshooting commands are prime targets. IT teams should treat this as an awareness and configuration issue, not just a browser update.

Watch for changes in warning copy, reports of bypasses, and whether attackers adapt their lures to avoid the new prompts. Verify that managed Chrome instances receive the rollout and that Enhanced Protection is enabled where policy allows.

À faire maintenant

1. Enable Enhanced Protection for managed Chrome profiles through policy where acceptable, and document any exceptions.
2. Train staff and students never to paste commands from web pages into terminals, run dialogs, or script hosts; provide a reporting path.
3. Restrict script interpreters and command execution on endpoints using application control or allowlisting.
4. Confirm Chrome updates and policy delivery so the new warnings appear on managed devices.
5. Monitor help-desk reports and endpoint telemetry for paste-then-execute behavior and follow up on near misses.
6. Review browser and endpoint logs for suspicious child processes spawned after browsing activity.
7. Communicate that no CVE is involved, so patching alone will not address the lure.

Source originale

The Hacker News