The third-party.com domain, used as a documentation placeholder similar to example.com, has been compromised and weaponized to deliver ClickFix malware lures to Windows users. Visitors on Windows are presented with a fake Cloudflare verification page that poisons their clipboard with a malicious PowerShell command, instructing them to execute it via the Run dialog (Win+R). This social engineering tactic leverages signed Windows binaries to bypass security detections. The domain is referenced in over 1,500 files across more than 1,700 repositories from trusted sources such as Chromium, Sanity, and Vercel, increasing the attack surface. Because third-party.com is not IANA-reserved, adversaries were able to register and exploit it. The campaign has been active since at least June 2026 and targets Windows users specifically, while showing benign content to other operating systems.

Windows users visiting third-party.com are at risk of executing a malicious PowerShell payload due to clipboard poisoning and social engineering. The widespread use of the domain in trusted repositories increases the likelihood of exposure. The attack bypasses traditional security tools by using signed Windows binaries, making detection and prevention more challenging. There is no indication of active exploitation in the wild beyond this campaign, and no direct CVE or software vulnerability is involved.

No official patch or fix is available as this is a social engineering campaign leveraging a compromised domain rather than a software vulnerability. Defenders should educate users to avoid executing clipboard-pasted commands from untrusted sources, especially when prompted by unexpected verification pages. Security teams should monitor for suspicious clipboard activity and PowerShell execution triggered by user input. Since the domain is not IANA-reserved, organizations should avoid using third-party.com as a placeholder domain in documentation or code to prevent accidental exposure. Traditional signature-based detection may be ineffective due to the use of signed binaries; behavioral detection and user awareness are critical.