Malicious Use of Placeholder Domain Tricks Windows Users into Running PowerShell Commands
A concerning trend has emerged in the cybersecurity landscape, where a commonly used placeholder domain is being exploited by attackers to distribute malware. The “third-party.com” domain, often used as an arbitrary external website or service in developer documentation and code examples, has been hijacked to serve a fake Cloudflare verification page that tricks Windows users into executing PowerShell commands.
This attack, known as ClickFix, uses social engineering tactics to convince victims to manually execute commands copied to their clipboard. The technique has become increasingly popular among attackers, as it allows malware to be installed via user-executed commands rather than being downloaded from websites or email attachments. In some cases, this can bypass traditional antivirus software.
Here’s how the attack works: when a Windows user visits a compromised website referencing “third-party.com”, they are presented with a fake Cloudflare verification page containing a “Verify you are human” prompt. After clicking the verification box, the site copies a malicious PowerShell command into the user’s clipboard and instructs them to paste it into the Windows Run dialog box (Windows key + R). When executed, this PowerShell command reconstructs the payload URL, downloads a malicious script from that address, and then executes it.
This attack specifically targets Windows users, with Linux and Mac visitors seeing error messages stating their operating system is unsupported. Manifold Security discovered this malicious use of “third-party.com” while examining public AI skills and MCP server documentation that referenced the domain.
What’s particularly interesting about this attack is the fact that “third-party.com” is a normally registered domain whose content its owner can control. Unlike example domains like example.com, example.net, and example.org, which are reserved specifically for documentation by IANA (Internet Assigned Numbers Authority), third-party.com has been used as a generic placeholder in developer documentation for years.
Examples of this misuse can be found in reputable sources such as the W3C Geolocation specification, Chromium’s Telemetry Extension API documentation, and even a PrivacyCG proposal on GitHub. These examples demonstrate how developers have copied code containing “third-party.com” into their own projects without realizing its potential security implications.
As this attack demonstrates, even seemingly innocuous placeholder domains can be hijacked by attackers to distribute malware. This serves as a reminder for developers to exercise caution when using external domains in their documentation and code examples, and for users to be vigilant when encountering unfamiliar websites or prompts that ask them to execute commands.
To protect yourself from such attacks, it’s essential to verify the authenticity of any webpage or prompt asking you to execute commands. Be wary of generic placeholders like “third-party.com” and never execute PowerShell commands copied from untrusted sources.
Source: Bleeping Computer — 2026-09-23