Google has announced new protections in Chrome designed to help stop ClickFix attacks, with the safeguards rolling out for users who have Enhanced Protection enabled. The move addresses a growing social engineering tactic in which attackers persuade users to copy and paste malicious commands into their device, bypassing many conventional security controls.

For European businesses, the update matters less as a browser feature alone and more as a signal of how attack methods are evolving. Instead of relying only on malware downloads or malicious attachments, attackers are increasingly trying to get employees to execute harmful actions themselves.

What happened

According to Google, Chrome is introducing improved warnings intended to protect users from ClickFix attacks when the browser's Enhanced Protection mode is enabled.

ClickFix is a form of social engineering. Rather than exploiting a software vulnerability directly, it attempts to manipulate a user into copying and running commands on their own system. That can allow attackers to sidestep some automated security controls that would normally block a suspicious download, email attachment or script.

Based on Google's description, the new Chrome safeguards are intended to interrupt that process with user-facing warnings before harmful commands are executed. At the time of the announcement, Google described the protection as tied to Enhanced Protection, meaning businesses should not assume the safeguard is active in every Chrome deployment by default.

Why it matters for European businesses

This development is relevant because ClickFix-style attacks can affect ordinary business workflows. Employees may encounter fake support prompts, bogus security alerts or fraudulent verification steps on compromised websites, malicious ads, phishing pages or other online content. The technique is effective precisely because it asks the user to perform what appears to be a legitimate troubleshooting or login-related action.

For SMEs and mid-sized organisations, this creates several practical risks:

• Traditional filtering may not be enough. If a user manually runs a command, the attack can bypass controls focused mainly on file downloads or known malicious links.
• Browser security settings matter more. Security features such as Chrome Enhanced Protection may reduce exposure, but only if they are enabled and centrally managed where possible.
• User awareness remains critical. Staff may not recognise that copying text into a system terminal, PowerShell window or command prompt can be as dangerous as opening malware.
• Compromised websites can become part of the attack chain. Even companies with strong email filtering can still be exposed if employees reach malicious or hijacked web pages through search, ads or third-party links.

The broader business lesson is that browser-based social engineering is becoming an operational security issue, not just a consumer threat. It can affect endpoint security, identity protection, SaaS access and business continuity.

Who may be affected

The risk is relevant across sectors, but some groups may be more exposed:

• SMEs with limited security resources that rely on default browser settings and informal staff security training.
• Distributed and hybrid teams where employees use web-based tools extensively and may troubleshoot issues without direct IT support.
• IT and support teams because attackers often imitate technical instructions or security remediation steps.
• E-commerce and digital businesses whose staff regularly access advertising platforms, analytics tools, CMS systems and third-party services through the browser.
• Regulated organisations that must demonstrate reasonable security controls around endpoint access, identity protection and staff awareness.

What companies should consider

Businesses do not need to wait for a major incident to respond. Practical steps may include:

• Review Chrome security settings. Check whether Enhanced Protection is permitted, recommended or centrally configurable in your organisation, and confirm how browser policies are managed across company devices.
• Update awareness training. Teach employees that they should be suspicious of any website or prompt asking them to copy and paste commands into a terminal, PowerShell, command prompt or browser console.
• Clarify support procedures. Staff should know how legitimate IT instructions are delivered internally, so they can distinguish approved guidance from fraudulent web prompts.
• Harden endpoint controls. Limit unnecessary local admin rights and review endpoint detection and response capabilities for suspicious script or command execution.
• Monitor web-based attack paths. Include malicious websites, fake verification pages and browser-driven social engineering scenarios in security testing and incident response playbooks.
• Communicate browser updates to staff. If your organisation standardises on Chrome, explain that new warnings are helpful but should not be treated as a complete defence.

Google's announcement is a useful reminder that many attacks now depend less on breaking software and more on persuading users to break their own security controls. For European businesses, reducing that risk requires a combination of browser policy, endpoint protection and practical staff guidance.