malware-traffic-analysis[.]net

A domain that has long appeared in software documentation, code examples, and developer test material is now being used to push a ClickFix attack against Windows users. A placeholder domain stands in for a website in an example. The best-known is probably example.com . Another, third-party[.]com , has often been used in documentation to represent an external website, API, or service. However, there is a very important difference between the two: example.com is reserved for documentation, while third-party[.]com is an ordinary domain. Anyone could register it, and someone did. Every document, test, and skill that hardcoded it now points readers and users to the attacker’s infrastructure. Researchers at Manifold Security found that third-party[.]com was serving a fake Cloudflare-style verification page to Windows visitors. The page tries to persuade them to open the Windows Run box and paste a command it has copied to their clipboard.This command is designed to download and execute a PowerShell script. At the time of writing the domain hosting the script is not resolving. ClickFix is a social-engineering technique that turns the victim into the malware installer. Instead of relying on a malicious attachment or an obvious executable download, the attacker convinces someone to run a command themselves. Common lures include: A fake CAPTCHA or Cloudflare Turnstile check. A browser error that claims it needs a “manual fix.” A bogus video-player, document-viewer, or popular software download. A support scam page that tells the visitor to paste a command into Run, Command Prompt, Terminal, or PowerShell. ClickFix works because the command often uses legitimate Windows or Mac tools to download and execute the next stage. It also runs with the permissions of the person who has been convinced to enter it. The consequences can range from information theft to more serious compromise of a company network. In a recent campaign called TerminalFix , a fake Cloudflare CAPTCHA led victims to paste a PowerShell command into Windows Terminal or PowerShell. How to stay safe With ClickFix running rampant—and it doesn’t look like it’s going away anytime soon—it’s important to be aware, careful, and protected. Slow down.  Be wary of a webpage that urges you to run commands on your device, especially if it uses a countdown or other pressure tactic. Don’t run commands or scripts from untrusted sources.  Never run code or commands copied from websites, emails, or messages unless you trust the source and understand the action’s purpose. Verify instructions independently. If a website tells you to execute a command or perform a technical action, check through official documentation or contact support before proceeding. Check what you’re pasting.  A website may copy a command to your clipboard without showing you the full text. Don’t paste it into a command window. Secure your device.  Use an up-to-date, real-time  anti-malware solution  with a web protection component. Educate yourself on evolving attack techniques.  Understanding that attacks may come from unexpected vectors and evolve helps maintain vigilance. Keep reading our blog! Pro tip:  The free  Malwarebytes Browser Guard  extension warns you when a website tries to copy something to your clipboard. Stop threats before they can do any harm. Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. The domain third-party.com has long been used in documentation to represent an arbitrary external website, API, or service, similar to how developers use domains such as example.com. However, unlike example.com, example.net, and example.org, which IANA reserves specifically for documentation, third-party.com is a normally registered domain whose content its owner can control. This difference is now a security concern after the domain began serving a ClickFix attack that impersonates a Cloudflare security check. Manifold Security first reported the malicious use of the domain after discovering it while examining public AI skills and MCP server documentation that referenced the domain. BleepingComputer has since confirmed that the page displays a fake Cloudflare "Performing security verification" CAPTCHA screen containing a "Verify you are human" prompt. After the user clicks the verification box, the site copies a malicious PowerShell command into the Windows Clipboard, and then instructs the user to press the Windows key + R, paste the contents of their clipboard using Ctrl+V, and press Enter. When the PowerShell command runs, it reconstructs the payload URL elxxvvx[.]xyz/f, downloads a PowerShell script from that address, and then executes it. This technique is commonly known as ClickFix, where attackers use fake errors, CAPTCHA prompts, or verification pages to convince victims to manually execute commands copied to their clipboard. ClickFix attacks have become a popular way to distribute malware, as the malware is installed via commands executed by the user rather than downloaded from websites or as email attachments. In some cases, this could allow malware to install while bypassing traditional antivirus software. At the time of BleepingComputer's testing, elxxvvx[.]xyz no longer resolved, leaving the current attack chain broken. However, a Hybrid Analysis report from May 2, 2026, shows the site distributed a PowerShell script configured to download a 134MB zip archive from: https://elxxvvx[.]xyz/update2.zip The PowerShell script saved the archive as update26.zip, extracted it, and then attempted to launch an executable named draw.io.exe. Because the update2.zip archive is no longer available, BleepingComputer couldn't determine what the payload does. Manifold's Ax Sharma says the attack specifically targets Windows users, and Linux and Mac visitors will see errors stating their operating system is unsupported. "A macOS or Linux user-agent gets none of that. It gets a near-identical page that stops at an error: "macOS is not supported. This website requires a Windows PC to access." No clipboard poisoning, no payload," explains Sharma. "The attacker only shows the weapon to the targets it works against, which is precisely why a casual look, or a scanner on a Linux datacenter IP, sees nothing wrong." A placeholder that wasn't reserved The more interesting aspect of the attack is the third-party.com domain chosen to host the ClickFix page. Public developer documentation has treated third-party.com as a generic example hostname for many years. For example, the W3C Geolocation specification currently demonstrates granting geolocation permissions to an external iframe using third-party.com as a placeholder domain: The W3C Compute Pressure specification similarly uses the domain when demonstrating how a website can enable the API for remote content: Chromium's documentation for its Telemetry Extension API also uses third-party.com as an example website permitted to communicate with a Chrome extension: Other examples go further and use the domain in code that would actually make network requests if copied literally. A PrivacyCG proposal on GitHub also uses the domain as the destination of a JavaScript fetch() request from a service worker. Posts online indicate that developers have copied these and similar examples into their own code and projects. In a 2015 Stack Overflow question, a developer said they had applied an asynchronous loading example containing https://third-party.com/resource.js to their website before discovering that it did not behave as expected after publishing the site. These examples do not mean that the associated projects or documentation are compromised. However, applications or test code that copied such placeholder URLs could now cause a browser or automated tool to contact the real third-party.com domain and potentially display the ClickFix attack in a browser or application. Unlike example.com, which IANA maintains for documentation and does not allow to be registered or transferred, the third-party.com domain has no such protection, and was clearly hijacked or registered at some point to conduct these ClickFix attacks. "third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays," explains Manifold. "A public code search turns it up in skills, MCP-server docs, and over 1,500 files across 1,700+ repositories from names as trusted as Chromium, Sanity, and Vercel. Since at least June 2026 it's been serving the ClickFix lure." While the widespread use of third-party.com as a placeholder in documentation makes the domain attractive to attackers, there is no evidence that it was registered for malicious purposes. The domain was first registered in 1996, long before the current campaign, and BleepingComputer has not determined when or how control of the site changed. At this time, there have been no reports that these references to third-party.com have actually resulted in ClickFix attacks being executed on developer's devices or within their applications/webpages. However, as the domain remains live, it could easily be switched to a new, live payload domain and actively utilized in future attacks. Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat

Introduction This diary describes a Remcos RAT infection that I generated in my lab on Thursday, 2026-03-11. This infection was from the SmartApeSG campaign that used a ClickFix-style fake CAPTCHA page. My previous in-depth diary about a SmartApeSG (ZPHP, HANEYMANEY) was in November 2025, when I saw NetSupport Manager RAT. Since then, I've fairly consistently seen what appears to be Remcos RAT from this campaign. Finding SmartApeSG Activity As previously noted, I find SmartApeSG indicators from the Monitor SG account on Mastodon, and I use URLscan to pivot on those indicators to find compromised websites with injected SmartApeSG script. Details Below is an image of HTML in a page from a legitimate but compromised website that shows the injected SmartApeSG script. Shown above: Page from a legitimate but compromised site that highlights the injected SmartApeSG script. The injected SmartApeSG script generates a fake CAPTCHA-style "verify you are human" page, which displays ClickFix-style instructions after checking a box on the page. A screenshot from this infection is shown below, and it notes the ClickFix-style script injected into the user's clipboard. Users are instructed to open a run window, paste the script into it, and hit the Enter key. Shown above: Fake CAPTCHA page generated by a legitimate but compromised site, showing the ClickFix-style command. I used Fiddler to reveal URLS from the HTTPS traffic, and I recorded the traffic and viewed it in Wireshark. Traffic from the infection chain is shown in the image below. Shown above: Traffic from the infection in Fiddler and Wireshark. After running the ClickFix-style instructions, the malware was sent as a ZIP archive and saved to disk with a .pdf file extension. This appears to be Remcos RAT in a malicious package that uses DLL side-loading to run the malware. This infection was made persistent with an update to the Windows Registry. Shown above: Malware from the infection persistent on an infected Windows host. Indicators of Compromise Injected SmartApeSG script injected into page from legitimate but compromised site: hxxps[:]//cpajoliette[.]com/d.js Traffic to domain hosting the fake CAPTCHA page: hxxps[:]//retrypoti[.]top/endpoint/signin-cache.js hxxps[:]//retrypoti[.]top/endpoint/login-asset.php?Iah0QU0N hxxps[:]//retrypoti[.]top/endpoint/handler-css.js?00109a4cb788daa811 Traffic generated by running the ClickFix-style script: hxxp[:]//forcebiturg[.]com/boot <-- 302 redirect to HTTPS URL hxxps[:]//forcebiturg[.]com/boot <-- returned HTA file hxxp[:]//forcebiturg[.]com/proc <-- 302 redirect to HTTPS URL hxxps[:]//forcebiturg[.]com/proc <-- returned ZIP archive archive with files for Remcos RAT Post-infection traffic for Remcos RAT: 193.178.170[.]155:443 - TLSv1.3 traffic using self-signed certificate Example of ZIP archive for Remcos RAT: SHA256 hash: b170ffc8612618c822eb03030a8a62d4be8d6a77a11e4e41bb075393ca504ab7 File size: 92,273,195 bytes File type: Zip archive data, at least v2.0 to extract, compression method=deflate Example of saved file location: C:\Users\[username]\AppData\Local\Temp\594653818\594653818.pdf Of note, the files, URLs and domains for SmartApeSG activity change on a near-daily basis, and the indicators described in this article are likely no longer current. However, the overall patterns of activity for SmartApeSG have remained fairly consistent over the past several months. --- Bradley Duncan brad [at] malware-traffic-analysis.net