ClickFix Attack Leverages Common Developer Placeholder Domain
The domain third-party.com, frequently used as a placeholder in developer documentation and code examples, is now serving a ClickFix attack that impersonates a Cloudflare security verification page to trick Windows users into executing malicious PowerShell commands.
Unlike IANA-reserved domains such as example.com, example.net, and example.org, third-party.com is a normally registered domain that anyone can control. This lack of restriction has allowed attackers to repurpose it for malicious activity, despite its long-standing role as a generic hostname in documentation.
How the Fake Cloudflare Page Works
BleepingComputer confirmed that visiting third-party.com displays a fake Cloudflare "Performing security verification" screen with a "Verify you are human" prompt. When users click the verification box, a malicious PowerShell command is copied to their Windows clipboard.
The site then instructs users to press Windows key + R, paste the clipboard contents using Ctrl+V, and hit Enter. This action triggers the execution of the command, which downloads and runs a PowerShell script from elxxvvx[.]xyz/f.
This technique is known as ClickFix — a social engineering method where fake errors, CAPTCHAs, or verification pages lure victims into manually running attacker-controlled commands. Because the malware is installed via user-executed commands rather than direct downloads or email attachments, it can sometimes bypass traditional antivirus defenses.
Payload Details and Current Status
At the time of BleepingComputer's testing, the payload URL elxxvvx[.]xyz no longer resolved, breaking the current attack chain. However, a Hybrid Analysis report from May 2, 2026, revealed that the site previously distributed a PowerShell script designed to download a 134MB ZIP archive from https://elxxvvx[.]xyz/update2.zip.
The script saved the file as update26.zip, extracted it, and attempted to launch an executable named draw.io.exe. Since the archive is no longer available, the exact purpose of the payload remains unknown.
Targeted Attack: Windows Only
According to Ax Sharma of Manifold Security, the attack specifically targets Windows users. Visitors using macOS or Linux user agents are shown an error message stating: "macOS is not supported. This website requires a Windows PC to access."
These non-Windows users receive no clipboard poisoning or payload delivery, making the attack invisible to security scanners or researchers using Linux-based systems or macOS devices.
Why third-party.com Is a Risky Placeholder
The core issue lies in how developer documentation treats third-party.com. It has been used for years as a generic example hostname — similar to example.com — but without any reservation or protection.
Examples of its use include:
- The W3C Geolocation specification, which uses third-party.com in an iframe for granting geolocation permissions.
- The W3C Compute Pressure specification, demonstrating API enablement for remote content.
- Chromium's Telemetry Extension API documentation, where it appears as an example site allowed to communicate with Chrome extensions.
- A PrivacyCG proposal on GitHub, referencing the domain in a service worker's JavaScript fetch() request.
These examples have been copied into real projects and test code. If such code runs in a browser or automated tool, it may now resolve to the live third-party.com domain and trigger the ClickFix lure.
Manifold Security reports that a public code search found the domain in over 1,500 files across 1,700+ repositories, including projects from Chromium, Sanity, and Vercel. The malicious use of the domain has been active since at least June 2026.
No Evidence of Exploitation — Yet
Despite the widespread use of third-party.com in documentation, BleepingComputer found no confirmed cases where these references led to successful ClickFix attacks on developer devices or within applications.
The domain was first registered in 1996, long before this campaign, and there is no indication it was originally acquired for malicious purposes. However, because it remains under attacker control, it could be reactivated with a new payload at any time.
As long as third-party.com continues to appear in public documentation and code samples, it presents a latent risk: a single copied line of code could unintentionally expose users to future attacks if the domain is repurposed again.
Source: BleepingComputer