third-party.com placeholder domain now serves ClickFix

The domain third-party.com, a common stand-in for external websites in developer documentation and code samples, is now hosting a fake Cloudflare verification page. The page tries to trick Windows users into running malicious PowerShell commands.

Manifold Security spotted the page while reviewing public AI skills and MCP (Model Context Protocol) server documentation that referenced the domain. BleepingComputer later confirmed the findings.

Developers have long used third-party.com the way they use example.com, to represent some arbitrary outside site, API or service. There is one important difference. IANA, the body that manages key internet naming resources, reserves example.com, example.net and example.org for documentation, and they cannot be registered or transferred. third-party.com has no such protection. It is an ordinary registered domain, and whoever owns it decides what it serves.

A fake CAPTCHA and a poisoned clipboard

Visitors see a spoofed Cloudflare "Performing security verification" screen with a "Verify you are human" checkbox. Clicking the box silently copies a PowerShell command into the Windows clipboard. The page then tells the user to press Windows key + R, paste with Ctrl+V and hit Enter.

The command rebuilds a payload URL, elxxvvx[.]xyz/f, fetches a PowerShell script from it and runs it.

This is a textbook ClickFix attack. Fake errors, CAPTCHA prompts or verification pages persuade victims to execute copied commands themselves. Because the user runs the command, no file has to be downloaded from a website or opened from an email attachment. In some cases, this can let the malware get past traditional antivirus software.

When BleepingComputer tested the page, elxxvvx[.]xyz no longer resolved, so the current attack chain is broken. A VirusTotal scan from May 2, 2026, shows the site previously delivered a PowerShell script that downloaded a 131MB zip archive named update2.zip. That archive is gone, so its purpose remains unknown.

Windows only, by design

According to Manifold's Ax Sharma, the lure is aimed only at Windows users. Visitors on macOS or Linux get a similar-looking page that ends in an error message.

"A macOS or Linux user-agent gets none of that. It gets a near-identical page that stops at an error: "macOS is not supported. This website requires a Windows PC to access." No clipboard poisoning, no payload," Sharma explained.

"The attacker only shows the weapon to the targets it works against, which is precisely why a casual look, or a scanner on a Linux datacenter IP, sees nothing wrong."

Years of references across trusted projects

The choice of domain makes this campaign stand out. third-party.com appears throughout public technical documentation. The W3C Geolocation specification uses it to show how to grant geolocation permissions to an external iframe. The W3C Compute Pressure specification uses it to show how a site can enable the API for remote content. Chromium's Telemetry Extension API documentation lists it as an example website allowed to talk to a Chrome extension.

Some examples go further and would trigger real network requests if copied as-is. A PrivacyCG proposal on GitHub, for instance, uses the domain as the target of a JavaScript fetch() call from a service worker.

Developers do copy these snippets. In a 2015 Stack Overflow question, one developer described adding an asynchronous loading example containing https://third-party.com/resource.js to their site, then finding it did not work as expected after publishing.

"third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays," Manifold said. "A public code search turns it up in skills, MCP-server docs, and over 1,500 files across 1,700+ repositories from names as trusted as Chromium, Sanity, and Vercel. Since at least June 2026 it's been serving the ClickFix lure."

None of this means those projects or their documentation have been compromised. The risk lies with applications or test code that copied the placeholder URLs literally. These could now cause a browser or automated tool to reach the live domain and display the lure.

The domain was first registered in 1996, long before this campaign. BleepingComputer has not established when or how control of it changed. There is also no evidence it was registered specifically for malicious use. So far, no one has reported ClickFix attacks actually running on developer machines or inside apps because of these references. However, the domain is still live, and its operators could point it to a new, working payload server at any time.

Our Take

This case shows how an old convention can become an attack surface. Developers treat example.com as safe because it is reserved. Many have probably assumed the same about third-party.com without checking who owns it. It is worth auditing codebases, test fixtures and internal docs for placeholder hostnames that are not reserved, and swapping them for example.com or similar.

The ClickFix technique itself keeps turning up. Attackers have used it before to deliver Mac malware, as seen with earlier versions of the MacSync infostealer. The Windows-only filtering here also suggests operators are getting better at hiding from automated scanners.

The discovery route matters too. Manifold found the domain in AI skills and MCP server docs. That suggests AI agents and tools that fetch URLs from documentation could stumble into such traps, much like the risks seen when attackers hijack AI agents. It is worth watching whether the domain is reactivated with a working payload, and whether other unreserved placeholder domains get similar treatment.