Security Independently confirmed 2 publishers 2 min read Published Sep 23, 2026, 5:09 PM PDT Updated Sep 25, 2026, 7:14 AM PDT

A placeholder domain from W3C specs and MCP docs is serving ClickFix PowerShell lures

third-party.com is an ordinary registered domain that developer documentation has used as a stand-in for years. It currently answers with a fake Cloudflare check that tells Windows users to paste a PowerShell command into the Run box.

The Watch · Security desk

Send a correction

What happened

The domain third-party.com is answering with a fake Cloudflare "Performing security verification" screen carrying a "Verify you are human" prompt, confirmed by BleepingComputer.
At the time of BleepingComputer's testing the second-stage host elxxvvx[.]xyz no longer resolved, so the chain as served currently breaks after the pasted command runs.
A Hybrid Analysis report dated May 2, 2026 shows the script pulling a 134MB zip from elxxvvx[.]xyz/update2.zip, saving it as update26.zip, extracting it and launching an executable named draw.io.exe.
IANA reserves example.com, example.net and example.org for documentation; third-party.com is an ordinary registered domain whose content its owner controls.

Why it matters

Who's exposed exposure Any project that pasted the iframe or fetch examples literally is now making requests to a host that serves attacker content, and in the Compute Pressure case it does so with a permission granted to that frame.
What it limits constraint Automated checks run from Linux sandboxes and datacenter IPs will keep recording a benign error page for this host, so the first usable signal is likely to be an endpoint spawning PowerShell from the Run box.
What's now possible capability Triage that leans on the dead download URL will age badly: the operator still controls the page that poisons the clipboard and needs only a resolving host at the other end.
Who has to decide decision Specification editors and documentation owners now choose between keeping a hostname whose content belongs to its registrant and switching examples to names IANA has reserved.

Next story · Leadership · Oct 8

Asos widens its breach disclosure after hackers share a data sample with the BBC

Confirmed2 publishers

Nothing in this chain is fetched by the browser. The page copies a PowerShell command into the Windows clipboard, then instructs the visitor to press Windows key + R, paste with Ctrl+V and press Enter ^[6]. The command runs in the user's own session. That is the property ClickFix is built on: the malware is installed by commands the victim types, not downloaded from a site or opened from an attachment, and BleepingComputer notes this can in some cases get it installed while bypassing traditional antivirus ^[8].

The page also decides who sees the payload. Manifold Security's Ax Sharma says the attack targets Windows users specifically, and that macOS and Linux visitors get an error saying their operating system is unsupported ^[10]. "The attacker only shows the weapon to the targets it works against, which is precisely why a casual look, or a scanner on a Linux datacenter IP, sees nothing wrong," Sharma said ^[11].

The string itself has been in public specifications for years. The W3C Geolocation specification uses third-party.com as the placeholder when demonstrating how to grant geolocation permission to an external iframe ^[17]. The W3C Compute Pressure specification carries the snippet `<iframe src="https://third-party.com" allow="compute-pressure"/>` ^[18]. Chromium's Telemetry Extension API documentation uses it as an example site permitted to talk to a Chrome extension ^[19]. A PrivacyCG proposal on GitHub uses it as the destination of a `fetch()` call from a service worker ^[20]. BleepingComputer names those four and does not put a number on how many documents use the domain ^[24]; Manifold found it while reading public AI skills and MCP server documentation that referenced it ^[4].

Some of those examples reach the network if copied literally ^[12], and posts online indicate developers have copied examples like them into their own code ^[14]. The Compute Pressure iframe is the sharpest case: pasted as written, it loads content controlled by whoever holds the registration, inside the developer's page, with compute-pressure permission granted ^[22]. This is not theoretical. In a 2015 Stack Overflow question, a developer said they had applied an asynchronous loading example containing https://third-party.com/resource.js to their site, and only found out after publishing that it did not behave as expected ^[13].

One domain covers both exposures. A resolver block on third-party.com kills the lure page and any copied code still pointing at it ^[23]. Finding the copies is a search for the literal string across repositories, vendored dependencies and skill files.

What to watch

Whether elxxvvx[.]xyz or a replacement second-stage host starts resolving again and restores the download step.
Whether the W3C, Chromium and PrivacyCG editors replace third-party.com in their examples with an IANA-reserved documentation domain.
Whether other unreserved placeholder hostnames circulating in AI skill files and MCP server examples get registered the same way.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence68
Adoption: Not scored
Hype gap+15
Incentives45
Confidence70

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
The domain third-party.com is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands.
Reported SupportedView cited source
[2]
third-party.com has long been used in developer documentation to represent an arbitrary external website, API or service, similar to how developers use example.com.
Reported SupportedView cited source
[3]
Unlike example.com, example.net and example.org, which IANA reserves specifically for documentation, third-party.com is a normally registered domain whose content its owner can control.
Reported SupportedView cited source
[4]
Manifold Security first reported the malicious use of the domain after discovering it while examining public AI skills and MCP server documentation that referenced the domain.
Reported SupportedView cited source
[5]
BleepingComputer confirmed that the page displays a fake Cloudflare "Performing security verification" CAPTCHA screen containing a "Verify you are human" prompt.
Reported SupportedView cited source
[6]
After the user clicks the verification box, the site copies a malicious PowerShell command into the Windows clipboard and instructs the user to press Windows key + R, paste with Ctrl+V and press Enter.
Reported SupportedView cited source
[7]
When the PowerShell command runs, it reconstructs the payload URL elxxvvx[.]xyz/f, downloads a PowerShell script from that address and executes it.
Reported SupportedView cited source
[8]
In ClickFix attacks the malware is installed via commands executed by the user rather than downloaded from websites or as email attachments, which in some cases could allow malware to install while bypassing traditional antivirus software.
Reported SupportedView cited source
[9]
At the time of BleepingComputer's testing, elxxvvx[.]xyz no longer resolved, leaving the current attack chain broken.
Reported SupportedView cited source
[10]
Manifold's Ax Sharma says the attack specifically targets Windows users, and Linux and Mac visitors will see errors stating their operating system is unsupported.
Reported SupportedView cited source
[11]
"The attacker only shows the weapon to the targets it works against, which is precisely why a casual look, or a scanner on a Linux datacenter IP, sees nothing wrong," Sharma said.
Reported SupportedView cited source
[12]
Some documentation examples use the domain in code that would actually make network requests if copied literally.
Reported SupportedView cited source
[13]
In a 2015 Stack Overflow question, a developer said they had applied an asynchronous loading example containing https://third-party.com/resource.js to their website before discovering that it did not behave as expected after publishing the site.
Reported SupportedView cited source
[14]
Posts online indicate that developers have copied these and similar examples into their own code and projects.
Reported SupportedView cited source
[15]
A Hybrid Analysis report from May 2, 2026 shows the site distributed a PowerShell script configured to download a 134MB zip archive from elxxvvx[.]xyz/update2.zip, save it as update26.zip, extract it and attempt to launch an executable named draw.io.exe.
Reported SupportedView cited source
[16]
Because the update2.zip archive is no longer available, BleepingComputer could not determine what the payload does.
Reported SupportedView cited source
[17]
The W3C Geolocation specification currently uses third-party.com as a placeholder domain when demonstrating how to grant geolocation permissions to an external iframe.
Reported SupportedView cited source
[18]
The W3C Compute Pressure specification uses the domain in the snippet <iframe src="https://third-party.com" allow="compute-pressure"/>.
Reported SupportedView cited source
[19]
Chromium's documentation for its Telemetry Extension API uses third-party.com as an example website permitted to communicate with a Chrome extension.
Reported SupportedView cited source
[20]
A PrivacyCG proposal on GitHub uses third-party.com as the destination of a JavaScript fetch() request from a service worker.
Reported SupportedView cited source
[21]
The lure stage is live on third-party.com while only the second-stage host is down, so the single missing element for a working chain is a resolving payload host.
Derived Supported
[22]
Copied as written, the Compute Pressure iframe example loads content controlled by the registrant of third-party.com inside the developer's page, with compute-pressure permission granted to it.
Derived Supported
[23]
Blocking third-party.com at the resolver stops both the ClickFix lure page and any copied code that still requests resources from the domain.
Derived Supported
[24]
BleepingComputer names four documentation examples that use the domain (W3C Geolocation, W3C Compute Pressure, Chromium Telemetry Extension API, a PrivacyCG proposal) and gives no total count of documents that reference it.
Derived Supported

Sources

2 independent publishers whose own reporting we read for this story.

bleepingcomputer.com
1 article · September 23, 2026
Placeholder domain used in dev docs now serves ClickFix attacks
malwarebytes.com
1 article · September 25, 2026
Criminals turn placeholder domain into ClickFix trap

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

The exposure is in code that copied a documentation example word for word. BleepingComputer names four current references, among them a W3C Compute Pressure iframe snippet and a PrivacyCG service-worker fetch() call. It also cites a 2015 Stack Overflow post from a developer who published a site loading https://third-party.com/resource.js. Any test fixture, skill file or MCP config that still names the domain now reaches whoever controls it.

Operator

The lure only appears to Windows visitors. Manifold's Ax Sharma said a scanner on a Linux datacenter IP "sees nothing wrong," so checking the page from a non-Windows host will miss it. Both BleepingComputer and Malwarebytes found the second-stage host elxxvvx[.]xyz not resolving, but the lure page itself was still up. Blocking third-party.com at the resolver cuts off both the lure and stray requests from copied code.

Investor

There is little here for investors. Nobody has reported a loss or an identified victim. The only commercial thread is the vendors involved: Manifold Security found the lure, and Malwarebytes closes its post by promoting its Browser Guard extension.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence68: 0100
Lure independently confirmed; final stage unknown
BleepingComputer reproduced the fake Cloudflare page and the clipboard command itself, and Malwarebytes' description matches. The weak point is the final stage. The archive was gone before anyone could analyse it, so what draw.io.exe does is not known.
AdoptionNot scored: No victim or exposure count
Neither report counts victims, and BleepingComputer says there have been no reports of the documentation references leading to an executed attack. Manifold's code search found the domain in over 1,500 files across more than 1,700 repositories. That shows how widely the placeholder is used. It does not show how many people or systems reached the malicious page.
Hype gap+15: −100 understated0 aligned+100 overstated
Mostly aligned, one stretch
The core claim holds: the domain does serve the lure. Malwarebytes goes further than the evidence when it says every document that used the domain now points readers to the attacker's infrastructure. Most of the cited examples are illustrative text, and the second-stage host was down when both outlets checked.
Incentives45: 0100
Vendor-originated, independently checked
Both the company that found the lure and the outlet that amplified it sell security products. Manifold Security found it while examining AI skills and MCP documentation, and Malwarebytes ends its post with a pitch for its free Browser Guard extension. The technical facts do not rest on either vendor's word, because BleepingComputer confirmed the page itself.
Confidence70: 0100
Firm on the lure, open on the attacker
I'd place reasonable confidence in the lure and the Windows-only gating, both of which BleepingComputer tested or quoted directly from Manifold. The attacker side is less certain. Nobody knows when control of the 1996-registered domain changed or what the final malware was, and BleepingComputer's own account contradicts itself on whether the domain was hijacked.

Topics and entities

Topics

Social Engineering and Voice Phishing
ClickFix attacks
Documentation placeholder domains