BleepingComputer (Lawrence Abrams, 24 September 2026, 6:46 am Perth) reports that third-party.com, a domain long used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare "Performing security verification" ClickFix page to Windows users. Unlike example.com, example.net and example.org, which IANA reserves for documentation, third-party.com is a normally registered domain whose owner controls its content.

BleepingComputer says Manifold Security first reported the malicious use after finding the domain in public AI skills and MCP server documentation, and it confirmed that clicking the verification box copies a malicious PowerShell command to the clipboard and tells the user to press Windows key + R, paste with Ctrl+V and press Enter; the command rebuilds the URL elxxvvx[.]xyz/f, downloads a PowerShell script from it and runs it. At the time of BleepingComputer's testing elxxvvx[.]xyz no longer resolved; a VirusTotal scan from 2 May 2026 shows the site distributed a PowerShell script that downloads a 131MB zip archive from elxxvvx[.]xyz/update2.zip, whose payload BleepingComputer could not determine.

Manifold's Ax Sharma told BleepingComputer that macOS and Linux visitors get a near-identical page that stops at an "OS not supported" error with no clipboard poisoning or payload, so a scanner on a Linux datacenter IP sees nothing wrong. BleepingComputer notes the W3C Geolocation and Compute Pressure specifications and Chromium's Telemetry Extension API documentation use third-party.com as an example. (source: BleepingComputer)

Correction (01 Nov 2026): the second-stage detail was wrong: BleepingComputer cites a VirusTotal scan from 2 May 2026 showing a PowerShell script that downloads a 131MB zip from elxxvvx[.]xyz/update2.zip, not a Hybrid Analysis draw.io.exe chain, and it does not describe an irm/iex command.

Manifold's post did not load for this desk, so the card now rests on BleepingComputer and is dated 24 September 2026 (Perth time) instead of 23 September. (source: BleepingComputer)