The domain third-party.com, long used as a fake example site in developer documentation, is now showing a bogus Cloudflare verification page that tries to trick Windows users into running malicious PowerShell commands. The campaign uses a ClickFix technique: after a victim clicks a fake CAPTCHA, the site copies a command to the clipboard and tells the user to paste it into Windows Run, which then downloads and executes a second-stage script from elxxvvx[.]xyz; macOS and Linux visitors reportedly see a nonfunctional unsupported-OS page instead.
Why it matters: Anyone who encounters third-party.com through old documentation, AI-generated code examples, or copied links could be exposed to malware. Defenders should block the domain and related infrastructure, review internal docs and tools that reference it, and remind users never to paste terminal or Run commands from web verification prompts.
info@thehackernews.com (The Hacker News)
2026.09.24
97% relevant
This appears to be the same underlying event and adds scope that the placeholder domain is referenced across more than 1,700 repositories, reinforcing the supply-chain and phishing exposure created by the domain now serving malicious content.
Lawrence Abrams
2026.09.23
100% relevant
This article establishes a distinct new security event: a previously common placeholder domain in public technical documentation has been repurposed into an active ClickFix malware lure, creating a concrete supply of plausible victim traffic from docs, tutorials, and AI-assisted development workflows.
← Back to all stories