The third-party.com domain, widely used as a placeholder in developer documentation and code examples, is hosting a ClickFix attack that impersonates a Cloudflare security verification page. When Windows users interact with the fake CAPTCHA, a malicious PowerShell command is copied to their clipboard and users are instructed to execute it manually, which downloads and runs malware. The attack is Windows-specific, with Linux and macOS users receiving an error message instead of the malicious payload. The domain is not reserved for documentation and is controlled by an external party, enabling attackers to use it maliciously. The attack was confirmed by multiple sources, including Manifold Security and BleepingComputer, with evidence of a payload download attempt from a now inactive domain. The widespread use of third-party.com in public documentation and code repositories means that developers copying these examples could inadvertently expose their users to this attack if the domain content remains malicious.

The attack can lead to malware infection on Windows systems if users follow the instructions to execute the clipboard-copied PowerShell command. This manual execution bypasses traditional download and execution detection methods, potentially allowing malware installation despite antivirus protections. The attack is limited to Windows users; Linux and macOS users are not affected. There is no evidence that the attack has been widely exploited in the wild or that developer applications referencing third-party.com have been compromised. However, the risk remains due to the domain's use in documentation and code examples.

At present, the malicious payload domain is inactive, breaking the attack chain. Users and developers should avoid executing unsolicited PowerShell commands copied to the clipboard, especially those prompted by suspicious web pages. Developers should replace references to third-party.com in documentation and code examples with domains reserved for documentation purposes such as example.com, example.net, or example.org to prevent accidental exposure. Monitor the status of third-party.com and related domains for any reactivation of malicious content. No official patch is applicable as this is an attack leveraging a third-party domain and user interaction.