Documentation placeholder domain used in ClickFix attacks
Placeholder domain third-party.com is serving ClickFix lures that execute remote PowerShell on Windows.
Manifold Security found that third-party.com, a domain commonly used as a documentation placeholder, is serving a ClickFix lure to Windows users. The page mimics a Cloudflare human check, poisons the clipboard, and tells victims to press Win+R and paste a command that pulls and runs a remote PowerShell payload. ESET reported ClickFix detections rose 108 percent between late 2025 and early 2026. The domain was reported to registrar Network Solutions, but the lure was still described as active.
- third-party.com is an unreserved documentation placeholder now serving malware
- A fake Cloudflare check poisons the clipboard and prompts Win+R
- The pasted command downloads and runs remote PowerShell
- ESET reported ClickFix detections rose 108 percent into early 2026
- The domain was reported to Network Solutions but remained risky
- Vendors
- Microsoft
- Products
- WindowsPowerShell
- Organizations
- Manifold SecurityNetwork SolutionsESET
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | third-party.com | The domain name third-party[.]com is being used to serve malware to users — bad news for th |
From the original article
1 min read at csoonline.com
The domain name third-party[.] com is being used to serve malware to users — bad news for those following a little too literally online documentation that uses it as a placeholder for any third-party domain. The site is serving a ClickFix lure to Windows machines, which sidesteps existing protection and can effect changes to PowerShell, according to Manifold Security, which discovered the problem.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.