A Popular Placeholder Domain Now Spreads Malware via Fake Cloudflare Page
A disturbing trend has emerged in the world of cybersecurity, where a commonly used placeholder domain is being exploited by attackers to spread malware. The “third-party.com” domain, often employed as a generic example hostname in developer documentation and code examples, has been hijacked to serve a fake Cloudflare verification page that tricks Windows users into executing malicious PowerShell commands.
This ClickFix attack, which attempts to convince victims to manually execute copied commands from their clipboard, has become a popular tactic among attackers. By using a fake error or CAPTCHA prompt, the malware is installed via user-executed commands rather than being downloaded from websites or email attachments. This technique can even bypass traditional antivirus software.
The “third-party.com” domain was initially used as a placeholder in developer documentation to represent an external website, API, or service. However, unlike example.com, which is reserved by IANA specifically for documentation purposes, third-party.com is a normally registered domain whose content its owner can control. This lack of protection has now become a security concern.
Manifold Security first reported the malicious use of this domain after discovering it in public AI skills and MCP server documentation that referenced the domain. BleepingComputer confirmed that the page displays a fake Cloudflare “Performing security verification” CAPTCHA screen containing a “Verify you are human” prompt. When the user clicks on the verification box, the site copies a malicious PowerShell command into their Windows Clipboard.
The attack then instructs the user to press the Windows key + R, paste the contents of their clipboard using Ctrl+V, and press Enter. When the PowerShell command runs, it reconstructs the payload URL elxxvvx[.]xyz/f, downloads a PowerShell script from that address, and executes it. Although the current attack chain appears broken, as the site no longer resolves at the time of writing, similar attacks have been observed in the past.
The use of this popular placeholder domain to spread malware raises concerns about the security implications of using unreserved domains in documentation. Developers often copy and paste examples from public documentation into their own code without considering the potential risks. This highlights the need for developers to be more vigilant when incorporating external resources into their projects.
To avoid falling victim to such attacks, it is essential for users to remain cautious when encountering verification pages or CAPTCHA prompts. If a page asks you to execute commands from your clipboard, do not proceed. Instead, report the suspicious activity to your system administrator or cybersecurity team. Additionally, developers should be aware of the potential risks associated with using unreserved domains in their documentation and code examples.
Ultimately, this incident serves as a reminder that even seemingly innocuous placeholder domains can pose significant security threats if exploited by attackers. As cybersecurity professionals, it is crucial to stay informed about emerging threats and take proactive measures to protect against them.
Source: Bleeping Computer — 2026-09-23