A commonly used documentation placeholder domain, third-party.com, was registered by an unknown party and is now serving a ClickFix social-engineering lure to Windows users. The page pretends to run a Cloudflare security check, silently poisons the clipboard, and tells victims to paste and run a command that fetches a remote PowerShell payload. Because the domain appears as a harmless “example endpoint” in 1,700+ public GitHub repositories, unsuspecting users and developers may follow it and be led to attacker-controlled content.
The domain third-party.com has long been used in documentation, tutorials, and code samples as a generic stand-in for an external API endpoint. Unlike example.com, it was never reserved by IANA, which means anyone can register and control it. An unknown party did exactly that, then configured the domain to serve a ClickFix-style lure to Windows visitors. The page displays a fake Cloudflare security check, silently loads a malicious command into the victim's clipboard, and instructs the user to paste and run it through the Windows Run dialog. That command fetches and executes a remote PowerShell payload, giving the attacker code execution on the victim's machine.
Several factors made this lure effective. The domain is referenced in more than 1,700 public GitHub repositories, so developers, readers of tutorials, and even automated tools may click through without a second thought, trusting it as a harmless placeholder. The attack also adapts based on the visitor's operating system: macOS users see a simple "not supported" message rather than the Windows-focused instructions, which reduces the chance that someone checking the site from a different device would flag it as malicious. This selective behavior means a quick manual review or automated scan from the wrong platform can miss the threat entirely.
Organizations should treat any non-reserved placeholder domain in internal or public-facing documentation as untrusted and replace references with IANA-reserved options like example.com, example.org, or example.net. Developers and engineering teams benefit from clear guidance that no legitimate website ever requires pasting and running a command in the Windows Run dialog or macOS Terminal to proceed. Because content served by these placeholder domains can vary by device or at request time, a one-time scan is not sufficient; documentation should be periodically audited for squattable domains. Building this awareness across developers, IT, and general staff reduces the chance that a routine click on a familiar-looking example link leads to compromise.
See MITRE ATT&CK for related techniques: https://attack.mitre.org/techniques/T1566/002/ and https://attack.mitre.org/techniques/T1204/002/.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An unknown party registered third-party.com, a domain commonly used as a stand-in example endpoint in documentation, and now uses it to serve a ClickFix lure that poisons the clipboard and prompts Windows users to run a malicious command.
Windows visitors see a fake Cloudflare security check that silently loads a command into the clipboard, then instructs the user to paste and run it via the Windows Run dialog, which fetches and executes a remote PowerShell payload.
It appears as a harmless example endpoint in over 1,700 public GitHub repositories, and macOS visitors are shown a benign decoy message instead of the attack, making casual checks less likely to catch the threat.
Security teams can audit documentation for non-reserved placeholder domains and use only IANA-reserved examples like example.com, example.org, or example.net instead.
You know those docs that say, “Call https://third-party.com/api”? That harmless placeholder is now a real site pushing malware. Windows users hitting third-party.com see a fake Cloudflare check. Behind the scenes, ClickFix swaps your clipboard and tells you to press Windows+R, paste, and run a PowerShell command it silently injected. On macOS, it’s sneakier: you might just see a bland “macOS not supported” message, or on other placeholder domains a fake “MacOS Security Center” screaming about four viruses and a 55% off McAfee renewal. Different devices, different lies. Here’s the rule: if any website tells you to open Windows Run or a terminal and paste a command to continue, stop right there and report it to security.
Researchers uncovered a long-running “SEO poisoning” operation that manipulates Bing search results to push people onto fake support and activation pages. Victims are steered through a chain of redirects to either download a malware-laced ZIP (MayaBot) or be pressured into calling a fake…
Attackers impersonated LastPass on GitHub and tricked people searching for the “LastPass Authenticator download” into installing a fake installer. The infection chain used a Microsoft-signed driver to disable many security tools, then deployed an infostealer that stole passwords, crypto wallets,…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Malwarebytes reports that a multi-stage Windows malware loader called PavinLoader is being delivered through multiple real-world campaigns, including ClickFix “verification” pages and fake software downloads. Victims are tricked into running installers or scripts that use legitimate Windows tools…
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
