Manifold Security (Organization): news timeline & CVEs

Documentation placeholder domain used in ClickFix attacks

Placeholder domain third-party.com is serving ClickFix lures that execute remote PowerShell on Windows.

Manifold Security found that third-party.com, a domain commonly used as a documentation placeholder, is serving a ClickFix lure to Windows users. The page mimics a Cloudflare human check, poisons the clipboard, and tells victims to press Win+R and paste a command that pulls and runs a remote PowerShell payload. ESET reported ClickFix detections rose 108 percent between late 2025 and early 2026. The domain was reported to registrar Network Solutions, but the lure was still described as active.

CSO OnlineSep 25, 16:42 UTC · 1d agoPhishing & fraud in the wild 4 sources

Criminals turn placeholder domain into ClickFix trap

Attackers registered documentation placeholder domain third-party.com and used it to serve Windows users a ClickFix fake-CAPTCHA page pushing a PowerShell downloader.

Manifold Security researchers found that third-party[.]com, an ordinary domain long hardcoded in software documentation and code examples as a placeholder, was registered by attackers and served a fake Cloudflare-style verification page to Windows visitors. The ClickFix page copied a command to visitors' clipboards and persuaded them to paste it into the Windows Run box, downloading and executing a PowerShell script; the script-hosting domain was not resolving at time of writing. Unlike example.com, which is reserved for documentation, third-party[.]com is registrable, so any docs or tests referencing it now point to attacker infrastructure.

Malwarebytes Labsupdated Sep 25, 16:42 UTC · 1d agofirst Sep 25, 12:42 UTC · 1d agoPhishing & fraud in the wild 4 sources

Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content

Squatted placeholder domain third-party.com now serves a Windows ClickFix lure referenced in over 1,700 repositories.

Manifold Security reports that third-party.com, a long-used documentation placeholder that is not IANA-reserved, has served a ClickFix lure to Windows browsers since at least June 2026 while showing a decoy or an unsupported-OS message to others. The page fakes a Cloudflare check, poisons the clipboard, and instructs the user to paste a command into the Windows Run dialog that fetches and runs a remote PowerShell payload. The domain appears in more than 1,700 public GitHub repositories, including AI agent skills and MCP server documentation, and is flagged by VirusTotal and Google Safe Browsing. Related placeholders yoursite.com and your-domain.com serve macOS scareware and investment-fraud pages and occur in far larger numbers of files.

The Hacker Newsupdated Sep 25, 16:42 UTC · 1d agofirst Sep 24, 15:27 UTC · 2d agoPhishing & fraud in the wild 4 sources

Placeholder domain used in dev docs now serves ClickFix attacks

Placeholder domain third-party.com, referenced across 1,700+ repositories, now serves fake Cloudflare ClickFix pages pushing clipboard-copied PowerShell commands at Windows users.

third-party.com, long used as a placeholder in W3C, Chromium, MCP server, and AI skills documentation and referenced in over 1,500 files across 1,700+ repositories, has been serving a ClickFix attack since at least June 2026. The page shows a fake Cloudflare 'Verify you are human' CAPTCHA that copies a malicious PowerShell command to the Windows clipboard, instructing users to run it via Windows+R; the command downloads and executes a script from elxxvvx[.]xyz (currently non-resolving). A May 2026 sample downloaded a 134MB zip archive launching an executable named draw.io.exe. Linux and macOS visitors receive an 'unsupported' error instead of the lure.

BleepingComputerupdated Sep 25, 16:42 UTC · 1d agofirst Sep 23, 22:46 UTC · 3d agoPhishing & fraud in the wild 4 sources

Manifold Security

Timeline4 articles

Appears with

Documentation placeholder domain used in ClickFix attacks

Criminals turn placeholder domain into ClickFix trap

Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content

Placeholder domain used in dev docs now serves ClickFix attacks