For years, **third-party.com** has been a common sight in developer documentation, serving as a placeholder for arbitrary external websites or APIs, akin to **IANA**-reserved domains like **example.com**. However, unlike its protected counterparts, **third-party.com** is a regularly registered domain, and its current owner has repurposed it for malicious activities. ### The ClickFix Deception Security firm **Manifold Security** first identified the malicious use of the domain, discovering it while examining public AI skills and **MCP** server documentation. **BleepingComputer** has since confirmed that the domain is hosting a fake **Cloudflare** 'Performing security verification' CAPTCHA page, prompting users to 'Verify you are human.' Upon clicking the verification box, the site subtly copies a malicious PowerShell command to the **Windows** Clipboard. It then instructs the user to press `Windows key + R`, paste the clipboard contents using `Ctrl+V`, and press `Enter`.  Executing this command initiates a PowerShell script download from a URL like `elxxvvx[.]xyz/f`, which is then executed on the victim's machine. This technique, known as ClickFix, circumvents traditional antivirus measures by having the user manually trigger the payload. At the time of **BleepingComputer**'s investigation, the `elxxvvx[.]xyz` domain was no longer resolving, effectively breaking the current attack chain. However, a **Hybrid Analysis** report from May 2, 2026, indicates that the site previously distributed a PowerShell script designed to download a 134MB zip archive, `update2.zip`, and then attempt to launch an executable named `draw.io.exe`. ### Targeting Windows Users Exclusively **Manifold Security**'s **Ax Sharma** noted that the attack is specifically tailored for **Windows** users. **Linux** and **macOS** visitors are presented with an error message stating their operating system is unsupported, preventing clipboard poisoning or payload delivery. This selective targeting allows attackers to focus their efforts on vulnerable systems, making detection more challenging for casual observation or automated scanners on non-Windows platforms. ### The Peril of Unreserved Placeholders The most concerning aspect of this attack is the choice of **third-party.com** itself. For years, the domain has been used in prominent documentation, including the **W3C Geolocation specification** and **W3C Compute Pressure specification**, as well as **Chromium**'s documentation for its **Telemetry Extension API**.  Developers have even copied these placeholder URLs literally into their own code and projects, as evidenced by a 2015 **Stack Overflow** question. While this doesn't imply compromise of the associated projects, applications or test code that incorporated such URLs could now inadvertently contact the malicious **third-party.com** domain, potentially exposing users to the ClickFix attack. Unlike **example.com**, which is permanently reserved by **IANA** and cannot be registered, **third-party.com** lacks such protection. This vulnerability allowed the domain to be registered or hijacked and subsequently weaponized. While the domain was first registered in 1996, the timeline and method of its control changing to facilitate these attacks remain undetermined. Currently, there are no reports of these references leading to actual ClickFix executions on developer devices or within applications. However, as the domain remains active, attackers could easily switch to a new, live payload, reactivating this potent attack vector in the future. This incident serves as a stark reminder for IT security professionals and developers to be cautious about the domains used even for illustrative purposes, especially those not officially reserved.