Criminals turn placeholder domain into ClickFix trap
Attackers registered documentation placeholder domain third-party.com and used it to serve Windows users a ClickFix fake-CAPTCHA page pushing a PowerShell downloader.
Manifold Security researchers found that third-party[.]com, an ordinary domain long hardcoded in software documentation and code examples as a placeholder, was registered by attackers and served a fake Cloudflare-style verification page to Windows visitors. The ClickFix page copied a command to visitors' clipboards and persuaded them to paste it into the Windows Run box, downloading and executing a PowerShell script; the script-hosting domain was not resolving at time of writing. Unlike example.com, which is reserved for documentation, third-party[.]com is registrable, so any docs or tests referencing it now point to attacker infrastructure.
- third-party[.]com, long used as a docs placeholder, was registered and weaponized by attackers.
- Fake Cloudflare CAPTCHA page tricks Windows users into pasting a PowerShell downloader via the Run box.
- example.com is reserved; third-party[.]com is an ordinary registrable domain anyone could own.
- Script-hosting domain was not resolving at time of writing.
- Organizations
- Manifold SecurityCloudflareMalwarebytes
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | third-party.com | example. The best-known is probably example.com . Another, third-party[.]com , has often been used in documentation to represent an ex |
From the original article
2 min read at malwarebytes.com
A domain used in software examples—third-party[.] com—now serves up a fake verification page that tells Windows users to run a PowerShell command.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.