Loading story…
The registrant-controlled third-party[.]com domain, widely used as a placeholder in developer documentation, is serving a Windows-targeted ClickFix lure disguised as a Cloudflare verification page. Windows visitors are instructed to paste and run a clipboard-poisoned PowerShell command that reconstructs a URL at elxxvvx[.]xyz and retrieves a second-stage script; analysis indicates the script downloaded an archive and attempted to execute draw.io.exe. The site has delivered the malicious workflow since at least June 2026, while macOS and Linux visitors receive error messages or benign content.
More than 1,700 public GitHub repositories reference the domain, including AI-agent skill and MCP-server documentation, creating a risk that users may follow a formerly innocuous example link into the attack flow. There is no evidence that repositories containing the placeholder were compromised or that copied links have resulted in confirmed executions. Researchers also identified 13 other non-reserved placeholder domains, including yoursite[.]com and your-domain[.]com, serving selectively targeted macOS scareware and investment-fraud pages.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
third-party.com has served a Windows-targeted ClickFix lure since at least June 2026. The site conditionally presents a fake Cloudflare verification page that poisons victims' clipboards and directs them to execute a PowerShell command via the Windows Run dialog.
A Hybrid Analysis record dated May 2, 2026 showed a downloaded PowerShell script configured to retrieve update2.zip from elxxvvx[.]xyz, save it as update26.zip, extract it, and attempt to run draw.io.exe.
The third-party.com domain was first registered in 1996. Unlike IANA-reserved example domains, it could be controlled by its registrant.
Manifold Security identified 13 additional non-IANA-reserved placeholder-style domains. It found that yoursite[.]com and your-domain[.]com selectively served macOS-targeted scareware and investment-fraud content while showing benign content to other visitors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcemanifold.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security agencies and researchers warned that **ClickFix** social-engineering attacks are spreading through fake verification and brand-impersonation pages that mimic services such as **Google reCAPTCHA** and **Cloudflare**, then trick users into opening `Win+R` or Terminal and pasting clipboard-loaded commands. Recent campaigns have used poisoned websites, fake search results, and spoofed update pages to push victims into launching malicious PowerShell, `mshta`, WebDAV, or shell-based payloads, turning trusted brands and verification flows into an initial access vector without directly compromising the impersonated organizations. The activity has delivered a wide range of malware, including **ACR Stealer**, **HijackLoader**, **StealC**, **Remus**, **Amatera Stealer**, **CastleLoader**, **NetSupport**, Rust-based stealers, and a DPRK-linked macOS backdoor tied to **Contagious Interview**. Microsoft said ACR Stealer campaigns targeting enterprise users stole browser credentials, cookies, tokens, and business files, used scheduled tasks and process injection for persistence and evasion, and in some cases relied on **EtherHiding** to resolve command-and-control infrastructure from Ethereum smart contracts; the macOS campaign similarly used clipboard-driven execution, LaunchAgent persistence, and follow-on payloads that targeted browser data, developer and cloud keys, and cryptocurrency wallets. Defenders were urged to block command execution from untrusted prompts, hunt for published indicators of compromise, and educate users that legitimate verification pages do **not** require running commands locally.
Jul 31, 2026
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 18, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026