A documentation placeholder domain now serves ClickFix attacks

The domain third-party.com, long used by developers to stand in for some arbitrary external website, API, or service — much like example.com — has been turned into a launchpad for a ClickFix attack. Manifold Security reported the abuse after spotting it while reviewing public documentation for AI skills and MCP servers, and BleepingComputer independently confirmed it.

What's happening

Windows visitors are shown a fake Cloudflare screen reading "Performing security verification" with a "Verify you are human" prompt. Clicking it copies a malicious PowerShell command to the clipboard, then tells the user to press Win+R, paste with Ctrl+V, and hit Enter.

The command reconstructs a payload URL — elxxvvx[.]xyz/f — downloads a PowerShell script from there, and runs it. That is the whole point of ClickFix: because the victim types the command themselves, the malware isn't downloaded straight from the site and can slip past some antivirus tools. At the time of testing, elxxvvx[.]xyz no longer resolved, so the chain was broken. A Hybrid Analysis report from May 2, 2026 shows the script previously fetched a 134MB zip archive, extracted it, and tried to launch draw.io.exe; what that payload did couldn't be determined, since the archive is gone.

The attack targets Windows only. macOS and Linux users get a nearly identical page that ends in an error saying their OS isn't supported — no clipboard poisoning, no payload. As Manifold's Ax Sharma puts it, the attacker "only shows the weapon to the targets it works against," which is exactly why a scanner on a Linux datacenter IP sees nothing wrong.

Why the placeholder went bad

Unlike example.com, example.net, and example.org, which IANA reserves for documentation and won't let anyone register, third-party.com is an ordinary domain whose owner controls the content. It was first registered back in 1996; when or how control changed hands isn't known, and there's no sign it was registered for malicious ends.

Meanwhile the domain shows up in W3C specifications (Geolocation, Compute Pressure), Chromium documentation, and countless code samples — by Manifold's count, in more than 1,500 files across over 1,700 repositories, including projects from Chromium, Sanity, and Vercel. Some examples contain real network requests, so developers who copied them verbatim could make a browser or tool reach the actual third-party.com.

There are no confirmed cases of successful attacks on developers' machines yet, and the lure has been live since at least June 2026. But the domain remains active, and its operator could swap in a fresh, working payload at any time.

Source: Bleeping Computer