Emerging ThreatsMalware & Ransomware

Malicious Site Exploits Placeholder Domain to Target Windows Users

Analyst 207||Source: BleepingComputer
Windows desktop with browser open on cluttered desk, displaying fake CAPTCHA prompt.

"A macOS or Linux user-agent gets none of that. It gets a near-identical page that stops at an error: 'macOS is not supported. This website requires a Windows PC to access,'" Manifold Security researcher Ax Sharma told BleepingComputer — and that simple tailoring is the reason this lure could be dangerous.

How the ClickFix lure works

Visitors to the site hosted on third-party.com see a fake Cloudflare "Performing security verification" CAPTCHA with a "Verify you are human" prompt. When a Windows user clicks the verification box, the page copies a PowerShell command into the Windows clipboard and then instructs the visitor to press Windows+R, paste the clipboard contents with Ctrl+V, and press Enter. That command reconstructs the payload URL elxxvvx[.]xyz/f, downloads a PowerShell script from that address and executes it.

Hybrid Analysis captured a May 2, 2026 sample showing the script downloaded a 134MB archive from https://elxxvvx[.]xyz/update2.zip, saved it as update26.zip, extracted it and attempted to launch an executable named draw.io.exe. At BleepingComputer's time of testing, elxxvvx[.]xyz no longer resolved, leaving the specific payload unavailable for inspection; because update2.zip was gone, BleepingComputer could not determine what the final payload did.

What Manifold and BleepingComputer found in documentation

Manifold Security discovered the malicious use of third-party.com while examining public AI skills and MCP server documentation that referenced the domain. BleepingComputer confirmed the CAPTCHA lure and the clipboard-copy behaviour during testing. Manifold says third-party.com has appeared in over 1,500 files across more than 1,700 repositories — in examples from projects including Chromium, Sanity and Vercel — and that "since at least June 2026 it's been serving the ClickFix lure."

Examples in standards and documentation include the W3C Geolocation and Compute Pressure specifications, Chromium's Telemetry Extension API documentation and a PrivacyCG proposal on GitHub; some examples use third-party.com in code that, if copied literally into an application, would make real network requests.

Why third-party.com mattered — and how it differs from reserved names

Unlike example.com, example.net and example.org, which IANA reserves specifically for documentation and does not allow to be registered or transferred, third-party.com is a normally registered domain whose content can be controlled by its owner. The domain was first registered in 1996, and at some point control changed — BleepingComputer has not determined when or how — after which the site began serving the ClickFix lure. Because the name has been widely used as a documentation placeholder, attackers had a ready-made, plausible landing page to weaponize.

Risks for copied code, scanners, and everyday users

Code or documentation that copied third-party.com literally can cause a browser or an automated tool to contact the live domain and potentially display the ClickFix attack in a Windows browser or application. Manifold notes the malicious page only shows the clipboard-poisoning and payload instructions to user-agents it detects as Windows, so a casual review or an automated scanner running from a Linux datacenter IP could miss the danger entirely.

ClickFix-style attacks rely on convincing users to execute commands they paste or run themselves; because the malware installation is triggered by commands executed by the user rather than a direct download from a site or an email attachment, the technique has in some cases allowed installers to evade traditional antivirus detection, the reporting explains.

What this means for developers, security teams, and end users

  • Developers: Audit examples and docs that use third-party.com and other non-reserved placeholders. Projects that literally copy example hostnames into published code risk directing browsers and service workers to a hostile site, as shown by the W3C, Chromium and other examples cited by Manifold.
  • Security teams and scanners: Be aware that attackers may tailor lures to show weaponized content only to Windows user-agents; Linux- or macOS-based scans can miss clipboard-poisoning behaviour. The Hybrid Analysis artefact dated May 2, 2026 demonstrates a download-and-extract chain involving a 134MB update2.zip and an attempted launch of draw.io.exe that defenders can watch for in telemetry.
  • End users: The attack flow depends on users executing a pasted command (Windows+R, Ctrl+V, Enter). Users on macOS or Linux will see the explicit message "macOS is not supported. This website requires a Windows PC to access." Windows users should be especially cautious when a site asks them to paste and run commands copied to the clipboard.

The simple, uncomfortable fact is this: a placeholder name used in documentation for years can become a live, weaponized landing page. Third-party.com is active now and could be repointed or paired with a new payload domain; despite the current payload domain (elxxvvx[.]xyz) failing to resolve during BleepingComputer's check, the attack chain and the wide use of the placeholder mean the risk remains real. Read the original reporting on BleepingComputer for full technical details and indicators: https://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/

Emerging ThreatsSocial EngineeringMalware OperationsCAPTCHA PhishingPowershell MalwareWindows ExploitationWindows User TargetingMalicious Website
Related Intelligence

Continue Reading

Smartphone on cluttered cafe table with laptop and coffee cup nearby.

RemControl Malware Targets European, Canadian Banking Users

Beware of a sneaky new Android malware called RemControl that's targeting banking users in Europe and Canada through clever phishing tactics and fake Google Play pages. This malware-as-a-service platform is spreading rapidly through fake stores, malicious ads, and tracking pixels.

Analyst 207
A coding workspace with laptop, papers, and notes in a bright, neutral-colored room with natural daylight.

North Korean Hackers Exploit Terraform Registry to Deliver Go Malware

In a groundbreaking move, North Korean hackers have exploited the Terraform Registry to spread Go-based malware, marking the first time threat actors have used this centralized repository as a distribution vector for malicious payloads. This alarming development was uncovered by security firm Aikido, which identified several malicious Terraform providers and Go modules published to public registries.

Analyst 207
Network equipment and monitors in a well-lit control room, with a focus on a VPN device on a rack.

Hackers Exploit Check Point VPN Flaws

Hackers have been actively exploiting two major flaws in Check Point VPNs, including one that allowed for remote code execution and another that enabled script execution, putting customers at risk. The attacks, which began as early as July 23, have now been confirmed by the cybersecurity company itself.

Analyst 207
F5 BIG-IP network appliance on a rack with cables and technicians in the background.

Attackers Exploit F5 BIG-IP APM Zero-Day Vulnerability

A critical zero-day vulnerability in F5 BIG-IP APM is under active attack, putting organizations at risk of remote code execution - and it's essential to take immediate action to protect yourself. This unpatched flaw is being exploited by attackers, making it crucial to act now to safeguard your systems.

Analyst 207