A Wecomply tool
Wecomply Argus
A browser extension that blocks ClickFix, scareware and fake-notification scams before they can trick you. It watches for the patterns these attacks rely on and shuts them down in the browser, before the instruction ever reaches you.
Blocked by Wecomply ArgusHERON
This page wants you to paste a command into Windows Run.
It is not a verification step. Following it installs software on your computer, and every security control on the machine will see a legitimate action — because it was one.
Product interface shown as designed. Copy inside the warning is drawn from the extension’s own strings.
These attacks don’t break into your computer. They convince you to do it for them.
A page throws up a fake error, a fake CAPTCHA, a fake virus warning or a fake system notification, and instructs you to copy a command and paste it into Windows Run or Terminal. Follow the instructions and you have installed the malware yourself.
Every security control on the machine sees a legitimate action, because it was one. The technique works on confident, technical people as reliably as anyone else, which is why it is spreading.
One mechanism, seven costumes. Argus scores each as its own family:
Stops the paste before it happens
The attack has one point of failure — the moment a command reaches your clipboard. Argus stands there. You can follow every instruction on the page and still paste nothing.
Detection is pattern-based and runs entirely on your device.
Warns before you allow a scam site
Fake virus alerts arrive as real system notifications from a site that was allowed to send them, often months earlier. Argus warns before the grant, and helps you find the ones already given.
Removing a grant is possible on Chrome and Edge; on Firefox and Safari, Argus names the sites and shows the route.
Covers the page that only wants a phone call
A fake renewal invoice, a fake support line, a fake browser update. None of these touch your computer, so these get a warning rather than a block — the honest response.
Warning states use red. Nothing else on this site does.
Refuses a swapped payment address
You copy a wallet address or an account number and the page quietly replaces it with its own. Argus sees the substitution happen and refuses the write. The signal is the replacement, not the address.
Neither address is stored, and a warning describes both while quoting neither.
Install it
One extension, from your browser’s own store. No account, no sign-in, nothing to configure.
It runs quietly
No dashboard to check and no daily digest. The toolbar icon is the only sign it is there, and it stays quiet until something is wrong.
It stops the attack first
The instruction is shut down in the browser before it reaches you. When Argus does interrupt, it says what it found and what it did.
Chrome 111+, Edge 111+, Firefox 128+ and Safari 18+ — one codebase, so every browser gets the same protection at the same time. Some capabilities differ by browser; the extension reports which, rather than pretending.
Argus asks for broad browser permissions. Here is exactly what it does with them.
To tell a fake virus warning from an ordinary page, the extension has to read the page you are on. That reading happens on your own computer, at the moment you open the page, and the text is discarded as soon as the check is finished.
Nothing leaves your device
The extension makes no network requests of any kind. There is no server, no account and no analytics, so there is nowhere for anything to go.
Enforced, not promised
Every way JavaScript can reach the network is replaced with a throwing stub before anything else runs. Tests assert it on every build.
Page text is discarded
Reading the page is the only way to tell a fake warning from an ordinary one. It happens in memory, at the moment you open the page, and is dropped when the check finishes.
Nothing is synced
The few settings it keeps live in your browser’s local storage on this computer. Sync would upload data off the device, so it is never used.
The same commitments are written into the extension’s store listing and its own privacy document, so the three cannot drift apart.
Full privacy policyGet told when Argus is out.
Argus is pre-release and has not been submitted to any browser store yet. Leave an address and you will hear once — when it is listed.