A ClickFix attack is appearing on third-party.com, a domain that many developer guides use as a placeholder. The site shows Windows users a fake security check and tries to persuade them to run a PowerShell command.
Fake Verification Page Targets Windows Users
Security company Manifold found the page while reviewing public AI skills and developer documentation. BleepingComputer later confirmed that it imitates a Cloudflare verification screen.
When a visitor clicks the verification box, the page copies a command to the Windows clipboard. It then tells the visitor to paste and run that command. If executed, the command attempts to download and launch a PowerShell script.
The page behaves differently for visitors using macOS or Linux. According to Manifold, those visitors see an unsupported operating system message rather than the malicious instructions.
During BleepingComputer’s testing, the script’s download domain no longer resolved. Therefore, the attack chain did not complete. An earlier analysis linked the domain to a large ZIP download, but researchers could not determine what its final payload did.
Documentation References Create Exposure
Developers have used third-party.com in examples for years. It appears in documentation and code samples as a stand-in for an external website or service.
However, anyone can register and control this domain. That differs from domains such as example.com, which are reserved for documentation.
As a result, someone who follows a copied example or opens the placeholder address may reach the live ClickFix attack page. The references in developer documentation do not mean those projects have suffered a compromise.
Researchers have not confirmed that any developer ran the malicious command after following such a reference. They also have not established when or how control of the domain changed. The domain dates back to 1996, and there is no evidence that its original registration had a malicious purpose.
0 responses to “Developer Placeholder Domain Hosts ClickFix Attack Page”