Placeholder domain used in dev docs now serves ClickFix attacks
Placeholder domain third-party.com, referenced across 1,700+ repositories, now serves fake Cloudflare ClickFix pages pushing clipboard-copied PowerShell commands at Windows users.
third-party.com, long used as a placeholder in W3C, Chromium, MCP server, and AI skills documentation and referenced in over 1,500 files across 1,700+ repositories, has been serving a ClickFix attack since at least June 2026. The page shows a fake Cloudflare 'Verify you are human' CAPTCHA that copies a malicious PowerShell command to the Windows clipboard, instructing users to run it via Windows+R; the command downloads and executes a script from elxxvvx[.]xyz (currently non-resolving). A May 2026 sample downloaded a 134MB zip archive launching an executable named draw.io.exe. Linux and macOS visitors receive an 'unsupported' error instead of the lure.
- Unreserved documentation placeholder third-party.com hijacked for ClickFix attacks since June 2026
- Fake Cloudflare CAPTCHA copies PowerShell downloader to clipboard for Windows+R execution
- Domain appears in 1,500+ files across 1,700+ repos including Chromium, Sanity, Vercel
- Payload domain currently non-resolving; no confirmed victim executions reported
- Tags
- clickfixphishingpowershellclipboard-hijackingcloudflare-impersonationsocial-engineeringsupply-chain
- Organizations
- third-party.comManifold SecurityCloudflareAx Sharma
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | elxxvvx.xyz | he PowerShell command runs, it reconstructs the payload URL elxxvvx[.]xyz/f, downloads a PowerShell script from that address, and t |
| domain | third-party.com | egistered at some point to conduct these ClickFix attacks. "third-party[.]com has been a generic documentation placeholder for years, t |
From the original article
4 min read at bleepingcomputer.com
The "third-party. com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.