PowerShell (Product): news timeline & CVEs

Documentation placeholder domain used in ClickFix attacks

Placeholder domain third-party.com is serving ClickFix lures that execute remote PowerShell on Windows.

Manifold Security found that third-party.com, a domain commonly used as a documentation placeholder, is serving a ClickFix lure to Windows users. The page mimics a Cloudflare human check, poisons the clipboard, and tells victims to press Win+R and paste a command that pulls and runs a remote PowerShell payload. ESET reported ClickFix detections rose 108 percent between late 2025 and early 2026. The domain was reported to registrar Network Solutions, but the lure was still described as active.

CSO OnlineSep 25, 16:42 UTC · 1d agoPhishing & fraud in the wild 4 sources

Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content

Squatted placeholder domain third-party.com now serves a Windows ClickFix lure referenced in over 1,700 repositories.

Manifold Security reports that third-party.com, a long-used documentation placeholder that is not IANA-reserved, has served a ClickFix lure to Windows browsers since at least June 2026 while showing a decoy or an unsupported-OS message to others. The page fakes a Cloudflare check, poisons the clipboard, and instructs the user to paste a command into the Windows Run dialog that fetches and runs a remote PowerShell payload. The domain appears in more than 1,700 public GitHub repositories, including AI agent skills and MCP server documentation, and is flagged by VirusTotal and Google Safe Browsing. Related placeholders yoursite.com and your-domain.com serve macOS scareware and investment-fraud pages and occur in far larger numbers of files.

The Hacker Newsupdated Sep 25, 16:42 UTC · 1d agofirst Sep 24, 15:27 UTC · 2d agoPhishing & fraud in the wild 4 sources

Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files

North Korea-linked Konni deployed VelvetCake PowerShell malware against Ukraine-focused targets via malicious LNK files.

SOCRadar reports that North Korea-linked Konni is running Operation Conflict Compass, a cyberespionage campaign against Ukraine-focused diplomatic, policy, NGO, and defense audiences. Spear-phishing ZIP archives contain LNK shortcuts disguised as PDFs; opening one runs PowerShell that downloads a VBScript persistence component and the VelvetCake downloader from GitHub. A scheduled task named OneDriveUpdateScheduler relaunches the lightweight task runner every minute, which fetches PowerShell modules over raw TCP port 12345, collects host and network data plus screenshots, exfiltrates results, and deletes artifacts. A trojanized Zoom installer variant was also used, and SOCRadar assesses a moderate-confidence link to Konni, also known as TA406 and Opal Sleet within the Kimsuky umbrella.

GBHackersupdated Sep 24, 13:39 UTC · 2d agofirst Sep 24, 09:34 UTC · 3d agoThreat actor in the wild 3 sources

TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data

Securonix details TASK#STOMP, a PowerShell backdoor stealing documents, Wi-Fi passwords, and clipboard data.

Securonix researchers disclosed TASK#STOMP, a campaign that uses wscript.exe to run an encoded VBScript and install a PowerShell backdoor. The malware harvests business documents, Wi-Fi passwords, clipboard contents, and screenshots, watches for new files, and accepts remote commands. Persistence uses disguised scheduled tasks plus a Startup-folder script, with redundant command-and-control at corecloudfileshare.xyz and attachmentsharingdrive.xyz. Initial access is unclear, though phishing is possible, and the chain later opens an Iranian government tenders site in Chrome.

The Hacker Newsupdated Sep 22, 13:45 UTC · 4d agofirst Sep 21, 14:15 UTC · 5d agoMalware in the wild 4 sources

PowerShell

Timeline4 articles

Appears with

Documentation placeholder domain used in ClickFix attacks

Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content

Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files

TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data