person

Ax Sharma

Security researcher and writer who publishes on malware campaigns and software supply chain threats.

Current clusters

The documentation placeholder third-party.com has served a ClickFix lure to Windows visitors since June

Manifold Security found third-party.com, a placeholder in more than 1,700 public repositories, serving a ClickFix clipboard lure to Windows browsers since at least June 2026. Static scans of the same files come back clean, because the server chooses what to send.

Publishers:thehackernews.com

Reality

Evidence58
Adoption62
Hype gap+12
Incentives62
Confidence60

security1 publisher

A placeholder domain from W3C specs and MCP docs is serving ClickFix PowerShell lures

third-party.com is an ordinary registered domain that developer documentation has used as a stand-in for years. It currently answers with a fake Cloudflare check that tells Windows users to paste a PowerShell command into the Run box.

Publishers:bleepingcomputer.com

Reality

Evidence72
Adoption28
Hype gap+12
Incentives55
Confidence66