Placeholder domain used in dev docs now serves ClickFix attacks

The domain third-party.com, commonly used as a placeholder in developer documentation, is now being used to serve a ClickFix attack that mimics a Cloudflare security verification page. When users click a 'Verify you are human' prompt, a malicious PowerShell command is copied to the clipboard, instructing them to paste and execute it via the Windows Run dialog. The command downloads and runs a PowerShell script that fetches a 134MB zip archive named update26.zip, which extracts and attempts to execute a file called draw.io.exe. The attack specifically targets Windows users, while macOS and Linux users are shown an error message and not served the malicious payload.

AI-extracted · verify before operational use