[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPRpsje0psvPpg8pbPVJD_tJhHlClCngLPWJCTnkfieU":3},{"article":4,"iocs":43,"watch_terms":59,"solutions":60,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"270f2d60-81d3-4245-bf1e-cf7812f5aad9","Placeholder domain used in dev docs now serves ClickFix attacks","placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks-3c5d97","The \"third-party.com\" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. [...]","The commonly used placeholder domain 'third-party.com' has been compromised and is now distributing a ClickFix attack. This attack impersonates a Cloudflare security verification page to trick Windows users into executing malicious PowerShell commands from their clipboard, which then downloads and executes further payloads.","Placeholder domain third-party.com now serves ClickFix attacks targeting Windows users.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fplaceholder-domain-used-in-dev-docs-now-serves-clickfix-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F09\u002F23\u002Fthird-party-clickfix-red.jpg","2026-09-23T22:46:01+00:00","2026-09-24T00:00:58.611949+00:00",8,[17,20,23],{"name":18,"type":19},"draw.io","product",{"name":21,"type":22},"PowerShell","technology",{"name":24,"type":22},"Cloudflare","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48,51,55],{"type":45,"value":46,"context":47},"domain","third-party.com","Malicious domain used for ClickFix attack impersonation.",{"type":45,"value":49,"context":50},"elxxvvx[.]xyz","Domain serving PowerShell script payload.",{"type":52,"value":53,"context":54},"url","https:\u002F\u002Felxxvvx[.]xyz\u002Fupdate2.zip","URL for a malicious zip archive payload.",{"type":56,"value":57,"context":58},"mitre_attack","T1059.001","PowerShell execution used in ClickFix attack.",[18],{"controls":61,"vendors":146},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":92,"name":93,"problem":94,"products":95},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"slug":121,"name":122,"problem":123,"products":124},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[125,133,140],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":134,"product_name":137,"url":138,"description":139},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":141,"product_name":142,"url":144,"description":145},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":163},"compromised-placeholder-domain-delivers-clickfix-social-engineering-attack","Compromised Placeholder Domain Delivers ClickFix Social Engineering Attack","The domain 'third-party.com', widely referenced as a placeholder in developer documentation, was compromised and weaponized to serve ClickFix attacks impersonating Cloudflare security verification pages. This attack exploits developer trust in familiar placeholder domains and manipulates users into pasting and executing malicious PowerShell commands from their clipboard. The incident highlights the danger of using real, resolvable domains as documentation placeholders, as users may inadvertently visit them or threat actors may acquire them. It also underscores the effectiveness of social engineering techniques that abuse legitimate-looking UI patterns, such as CAPTCHA or verification prompts, to bypass user skepticism. Organizations that reference such domains in training materials, code samples, or internal docs may unknowingly be directing developers and users toward a malicious host.",[152,153,154,155,156,157,158,159,160,161,162],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 18: Penetration Testing","NIST SP 800-53 SC-18: Mobile Code","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 CM-7: Least Functionality","RFC 2606: Reserved Top Level DNS Names (for safe placeholder use)","MITRE ATT&CK T1059.001: Command and Scripting Interpreter – PowerShell","MITRE ATT&CK T1204.001: User Execution – Malicious Link","MITRE ATT&CK T1566.002: Phishing – Spearphishing Link",{}]