Placeholder Domain in Developer Docs Now Delivers ClickFix Malware Attacks
The domain third-party.com, long used as a placeholder in developer documentation and code examples, is now serving a ClickFix attack that impersonates a Cloudflare security check. Unlike IANA-reserved domains such as example.com, third-party.com is a normally registered domain whose owner controls its content. Manifold Security first discovered the malicious activity while reviewing public AI skills and MCP server documentation that referenced the domain.
When visitors land on the domain, they see a fake Cloudflare "Performing security verification" CAPTCHA screen with a "Verify you are human" prompt. Clicking the verification box copies a malicious PowerShell command to the Windows Clipboard, then instructs users to press Windows key + R, paste the command with Ctrl + V, and hit Enter. The executed command downloads a PowerShell script from a remote payload URL, a hallmark of the ClickFix technique, which tricks victims into manually running attacker-supplied commands.
Researchers note that ClickFix attacks are increasingly popular because malware is installed by the user's own actions rather than downloaded as attachments, potentially bypassing traditional antivirus software. At the time of testing, the payload domain elxxvvx[.]xyz no longer resolved, breaking the attack chain. However, a May 2026 Hybrid Analysis report shows the site previously distributed a script that downloaded a 134MB zip archive containing the malicious payload.