Docs Placeholder Domain Hijacked to Serve ClickFix Attacks

Executive Summary

A critical supply chain and social engineering risk has emerged following the weaponization of `third-party.com`, a domain historically treated by software engineers and technical authors as an arbitrary placeholder hostname. Identified by Manifold Security and corroborated by BleepingComputer, the domain has been observed serving a deceptive ClickFix social engineering lure designed to compromise Windows endpoints through clipboard hijacking and manual PowerShell execution.

For over two decades, technical specifications and official documentation—including the World Wide Web Consortium (W3C) Geolocation and Compute Pressure specifications, Chromium's Telemetry Extension API guides, and popular repositories from Vercel and Sanity—have utilized third-party.com to illustrate external API calls, cross-origin iframes, and service worker fetch requests. Unlike IANA-governed domains such as example.com, third-party.com enjoys no statutory protection and operates as a privately registrable domain.

Adversaries controlling the domain have configured targeted visitor filtering: Linux and macOS clients receive benign error pages, while Windows visitors are presented with a spoofed Cloudflare security verification screen. Interacting with the CAPTCHA silently injects an obfuscated PowerShell loader into the victim's clipboard, coaxing the user into executing it via the Windows Run dialog (Win+R).

Technical Vulnerability Analysis & Attack Chain

The intrusion relies on an ingenious fusion of documentation-derived supply chain exposure and client-side social engineering:

1. Documentation Ingestion & Public Repository Exposure: Developers writing code, unit tests, or artificial intelligence skills routinely copy code samples from technical standards into their projects. Public code searches revealed third-party.com hardcoded in more than 1,500 source files across 1,700+ repositories, including modern AI skills and Model Context Protocol (MCP) server documentation. When developers, automated QA runners, or LLM web browsing agents access these sample links, traffic routes directly to the adversary-controlled server.
2. User-Agent Fingerprinting & Cloaking: The web server inspects the connecting client's User-Agent header upon connection. If the client is identified as macOS or Linux, the site aborts the attack, rendering: "macOS is not supported. This website requires a Windows PC to access." This selective delivery completely shields the malicious infrastructure from Linux-based threat intelligence crawlers, web scanners, and automated datacenter sandboxes.
3. Deceptive Cloudflare CAPTCHA Lure: When a Windows User-Agent is detected, the server serves a convincing replica of a Cloudflare Turnstile / DDoS protection interstitial titled "Performing security verification" with a checkbox reading "Verify you are human".
4. Clipboard Injection via Browser APIs: When the victim clicks the verification checkbox, client-side JavaScript calls the Clipboard API (navigator.clipboard.writeText or document.execCommand('copy')). An obfuscated PowerShell command line is silently written into the local operating system clipboard.
5. ClickFix Run Dialog Coercion: A modal pop-up displays instructional steps commanding the user to press Windows Key + R (opening explorer.exe's Run dialog), followed by Ctrl + V (pasting the clipboard payload) and Enter. Because the command executes directly within the operating system shell rather than as an executable download within the browser, it bypasses standard browser download warnings, SmartScreen URL reputation, and web perimeter AV gateways.
6. Staged PowerShell Malware Delivery: Upon execution, the PowerShell one-liner dynamically reconstructs the secondary distribution endpoint elxxvvx[.]xyz/f, downloads an obfuscated stage-2 script in memory, retrieves a 134MB ZIP archive (update2.zip saved as update26.zip), extracts its contents, and attempts to execute a packaged binary named draw.io.exe.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

The ClickFix campaign is operated by opportunistic cybercrime groups specializing in initial access brokerage and malware distribution. ClickFix tactics have proliferated across 2025 and 2026, increasingly favored by infostealer syndicates (such as Lumma, Vidar, and Stealc operators) because it offloads code execution onto the victim, evading browser perimeter sandboxes.

While third-party.com was originally registered in 1996 as a legitimate domain, the current operators either acquired the expired registration or took control of the authoritative DNS records to exploit its widespread footprint in developer documentation. The campaign deliberately targets technical workers, software engineers, and automated AI browsing agents whose elevated network access provides high-value beachheads into corporate development environments.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Enforce RFC 2606 / RFC 6761 Reserved Domains: Audit all internal repositories, developer documentation, API specifications, and automated test suites. Replace all instances of third-party.com with globally reserved documentation domains: example.com, example.org, example.net, or dedicated .example / .test top-level domains.
• Sanitize AI Skill & MCP Server Configurations: Inspect MCP server manifests and agentic skill definitions to ensure tool integrations and prompt examples do not point to unverified external domains.
• User Awareness Training: Educate developers and technical personnel on the mechanics of ClickFix attacks: legitimate CAPTCHAs and security checks will never require opening the Windows Run dialog (Win+R) or pasting clipboard text into a terminal.

2. Network & Perimeter Defenses

• DNS Sinkhole / Perimeter Block: Immediately configure enterprise DNS resolvers, secure web gateways (SWGs), and firewall egress filters to block all inbound and outbound traffic to third-party.com and known distribution host elxxvvx[.]xyz.
• Inspect Developer Workstation Egress: Alert on workstation connections to newly observed .xyz domains, particularly when initiated by command-line interpreters (powershell.exe, cmd.exe).
• Restrict Clipboard API Access: In corporate browser policies (Google Chrome / Microsoft Edge), restrict untrusted web applications from writing to the system clipboard without explicit user confirmation prompts.

3. Endpoint Detection & Hunting Query

title: ClickFix PowerShell Execution Spawned from Windows Run Dialog
id: 7c4e1a29-8f3b-4d10-9012-567890abcdef
status: experimental
description: Detects powershell.exe spawned directly by explorer.exe containing obfuscated flags, hidden windows, or download primitives indicative of ClickFix attacks.
author: CyberNewsAI Threat Intelligence
references:
  - https://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/
tags:
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1115
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_args:
    CommandLine|contains:
      - '-w hidden'
      - '-windowstyle hidden'
      - 'elxxvvx'
      - 'update2.zip'
      - 'update26.zip'
      - 'draw.io.exe'
      - 'DownloadString'
      - 'DownloadFile'
      - 'Net.WebClient'
  condition: selection_parent and selection_powershell and selection_args
falsepositives:
  - Highly unusual manual administrator execution of hidden PowerShell one-liners via the Run dialog
level: critical

// Microsoft Sentinel / Defender Hunting Query: Detect ClickFix Clipboard-to-Run PowerShell Execution
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| where ProcessCommandLine has_any (
    "-w hidden",
    "-windowstyle hidden",
    "elxxvvx",
    "update2",
    "third-party.com",
    "draw.io.exe",
    "FromBase64String",
    "DownloadData"
)
| project Timestamp, DeviceName, ActionType, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| sort by Timestamp desc

Network Indicators & Malicious Domains

File Artifacts & Process Telemetry