Common documentation domain third-party.com now hosts Windows ClickFix attack

A long-used placeholder host in web docs now points to attacker-controlled infrastructure serving a malicious Windows ClickFix flow.

The long‑used documentation placeholder domain third-party.com is currently serving a malicious ClickFix page impersonating a Cloudflare security check, specifically targeting Windows users. When a visitor clicks the fake CAPTCHA, the site copies a PowerShell command to the clipboard and instructs the user to run it via Win+R, which then downloads and executes a PowerShell script from elxxvvx[.]xyz. That script previously attempted to fetch a 134MB update2.zip archive, extract it as update26.zip, and launch an executable named draw.io.exe, although the payload is no longer available for analysis. Unlike IANA‑reserved example.com/.net/.org, third-party.com is a normal registered domain that has been widely used in web standards, browser documentation and public code as an example host, meaning copied snippets may now contact the attacker‑controlled site. Researchers have found references to third-party.com in more than 1,500 files across over 1,700 repositories, but there are currently no confirmed incidents of these references leading to successful ClickFix infections.