--- title: Placeholder domain used in dev docs now serves ClickFix... description: The domain third-party.com, long used as a generic placeholder hostname in developer documentation (W3C specs, Chromium docs, GitHub proposals, and thousands... canonical: https://daily.dev/posts/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks-wru8ylvti twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Placeholder domain used in dev docs now serves ClickFix attacks | daily.dev og:description: The domain third-party.com, long used as a generic placeholder hostname in developer documentation (W3C specs, Chromium docs, GitHub proposals, and thousands... og:url: https://daily.dev/posts/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks-wru8ylvti og:image: https://api.daily.dev/og/posts/WrU8ylVti.png og:image:alt: Placeholder domain used in dev docs now serves ClickFix attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Placeholder domain used in dev docs now serves ClickFix attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 5 min read · 1 upvotes · 1 comments ## Summary The domain third-party.com, long used as a generic placeholder hostname in developer documentation (W3C specs, Chromium docs, GitHub proposals, and thousands of repositories including Chromium, Sanity, and Vercel), is now serving a ClickFix attack. Windows visitors see a fake Cloudflare verification page that copies a malicious PowerShell command to the clipboard and tricks users into pasting and running it via Win+R, which downloads and executes a payload; macOS and Linux visitors see only an unsupported-OS error, evading casual scanning. Unlike example.com, which IANA reserves and protects from registration, third-party.com is a normal domain that appears to have been hijacked or re-registered, with the malicious activity traced back to at least June 2026. Developers who copied literal third-party.com URLs into live code or test scripts could inadvertently trigger requests to the compromised domain. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is third-party.com now considered dangerous if I copied it from documentation examples? The domain third-party.com, long used as a generic placeholder hostname in developer docs like the W3C Geolocation and Compute Pressure specs, Chromium's Telemetry Extension API docs, and GitHub proposals, was hijacked and now serves a ClickFix attack. A public code search found it in over 1,500 files across 1,700+ repositories from projects including Chromium, Sanity, and Vercel, so code or test scripts that reference it literally could trigger contact with the malicious site. _Developers auditing old code for stale placeholder domains can track emerging security disclosures like this on daily.dev._ ### How does the third-party.com ClickFix attack trick Windows users into running malware? It displays a fake Cloudflare "Performing security verification" CAPTCHA page; after clicking the verification box, it silently copies a malicious PowerShell command to the Windows clipboard and instructs the user to press Win+R, paste with Ctrl+V, and press Enter. The command then downloads and executes a payload script, in one documented case a 134MB archive containing an executable disguised as draw.io.exe. _Anyone tracking ClickFix-style social engineering tactics can follow ongoing security research on daily.dev._ ### Why do macOS and Linux users not see the third-party.com ClickFix attack payload? The attack checks the visitor's user-agent and only serves the clipboard-hijacking PowerShell payload to Windows users; macOS and Linux visitors instead see an error stating the website requires a Windows PC, with no clipboard poisoning or payload delivered. This targeting also helps the campaign evade casual inspection or scans run from Linux-based systems. _Security teams evaluating platform-targeted attack techniques can stay current via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@yildirim** · 2 upvotes > Why did anyone using a random domain other than example.com ## Similar posts on daily.dev - [Fake Cloudflare CAPTCHA tricks victims into opening a tunnel for attackers](https://daily.dev/posts/fake-cloudflare-captcha-tricks-victims-into-opening-a-tunnel-for-attackers-gtqaorplr) · CSO Online · 0 upvotes · 0 comments - [Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks](https://daily.dev/posts/hackers-hijack-thousands-of-sites-for-clickfix-and-fakeupdate-attacks-lln9cssgx) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks-wru8ylvti) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Placeholder domain used in dev docs now serves ClickFix attacks","url":"https://daily.dev/posts/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks-wru8ylvti","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks-wru8ylvti"},"datePublished":"2026-09-23T22:50:02.666Z","dateModified":"2026-09-25T17:10:54.212Z","description":"The domain third-party.com, long used as a generic placeholder hostname in developer documentation (W3C specs, Chromium docs, GitHub proposals, and thousands...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8852f55ccfa73bcca84f9ecb23016fc4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8852f55ccfa73bcca84f9ecb23016fc4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks-wru8ylvti","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,malware","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Placeholder domain used in dev docs now serves ClickFix attacks"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks-wru8ylvti","comment":[{"@type":"Comment","text":"Why did anyone using a random domain other than example.com","datePublished":"2026-09-24T11:34:15.479Z","url":"https://daily.dev/posts/WrU8ylVti#c-ISMlWylma","author":{"@type":"Person","name":"Yasin İsa YILDIRIM","url":"https://daily.dev/yildirim","image":"https://media.daily.dev/image/upload/s--i098KjZN--/f_auto/v1727931829/avatars/avatar_EsTd0u1bqW4Q1cI9yRp5N"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks-wru8ylvti#faq","mainEntity":[{"@type":"Question","name":"Why is third-party.com now considered dangerous if I copied it from documentation examples?","acceptedAnswer":{"@type":"Answer","text":"The domain third-party.com, long used as a generic placeholder hostname in developer docs like the W3C Geolocation and Compute Pressure specs, Chromium's Telemetry Extension API docs, and GitHub proposals, was hijacked and now serves a ClickFix attack. A public code search found it in over 1,500 files across 1,700+ repositories from projects including Chromium, Sanity, and Vercel, so code or test scripts that reference it literally could trigger contact with the malicious site. Developers auditing old code for stale placeholder domains can track emerging security disclosures like this on daily.dev."}},{"@type":"Question","name":"How does the third-party.com ClickFix attack trick Windows users into running malware?","acceptedAnswer":{"@type":"Answer","text":"It displays a fake Cloudflare \"Performing security verification\" CAPTCHA page; after clicking the verification box, it silently copies a malicious PowerShell command to the Windows clipboard and instructs the user to press Win+R, paste with Ctrl+V, and press Enter. The command then downloads and executes a payload script, in one documented case a 134MB archive containing an executable disguised as draw.io.exe. Anyone tracking ClickFix-style social engineering tactics can follow ongoing security research on daily.dev."}},{"@type":"Question","name":"Why do macOS and Linux users not see the third-party.com ClickFix attack payload?","acceptedAnswer":{"@type":"Answer","text":"The attack checks the visitor's user-agent and only serves the clipboard-hijacking PowerShell payload to Windows users; macOS and Linux visitors instead see an error stating the website requires a Windows PC, with no clipboard poisoning or payload delivered. This targeting also helps the campaign evade casual inspection or scans run from Linux-based systems. Security teams evaluating platform-targeted attack techniques can stay current via daily.dev."}}]} ```