Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Third-party.com fake Cloudflare verification ClickFix campaign targeting Windows users

Campaign
First reported
Last updated
Happening score
H score 24
2 unique sources, 2 articles

Summary

Hide ▲

The third-party.com domain is hosting a ClickFix lure that impersonates a Cloudflare security check and pushes Windows users to run malicious PowerShell commands. The page uses clipboard poisoning and a fake verification flow to steer victims toward a payload chain on elxxvvx[.]xyz. The abuse turns a long-used placeholder hostname into an active delivery point for malware installation attempts.

Related Happenings

ClickFix-based TELEPUZ distribution campaign

Campaign
H score35 First: 16.07.2026 15:50 Last: 16.07.2026 15:50 Sources 1

About this happening: The ClickFix-based TELEPUZ distribution campaign is pushing TELEPUZ through websites infected with lures, increasing the chance that victims run malicious commands and...

Open Happening

LastPass and Bitwarden users targeted by fake-security-notice phishing campaign

Campaign
H score31 First: 14.07.2026 18:31 Last: 14.07.2026 18:31 Sources 1

About this happening: An ongoing phishing campaign is using fake security notices to lure LastPass and Bitwarden users to fraudulent websites, creating immediate credential theft risk f...

Open Happening

ClickFix mitigation guidance for Windows and macOS

Defensive Guidance
H score34 First: 30.06.2026 15:00 Last: 30.06.2026 15:00 Sources 1

About this happening: Organizations are being urged to harden defenses against ClickFix on Windows and macOS, reducing the chance that social-engineering lures can turn trusted dialogs into...

Open Happening

Google DoubleClick malspam campaign delivering DesckVB RAT

Campaign
H score33 First: 03.06.2026 19:29 Last: 03.06.2026 19:29 Sources 1

About this happening: A new malspam campaign is abusing Google's DoubleClick redirect path to evade detection and deliver DesckVB RAT, putting users and organizations at risk of malware inf...

Open Happening

WeedHack YouTube and SEO poisoning campaign targeting Minecraft players

Campaign
H score73 First: 03.06.2026 00:54 Last: 03.06.2026 00:54 Sources 1

About this happening: WeedHack is a Minecraft-focused malware campaign that uses SEO poisoning, YouTube, and fake gaming sites to push malicious clients and other downloads to players....

Open Happening

Timeline

  1. 24.09.2026 18:27 1 articles · 13d ago

    Manifold Security expands third-party[.]com ClickFix campaign to 13 more placeholder domains

    Campaign Scope Update

    Manifold Security says third-party[.]com has served a ClickFix lure to Windows browsers since at least June 2026, and the broader abuse now extends to 13 additional non-IANA-reserved placeholder domains, including yoursite[.]com and your-domain[.]com, which show scams and scareware to macOS visitors while serving ordinary parking pages to other users.

    Show sources
    Open in new tab
  2. 24.09.2026 01:46 2 articles · 13d ago

    Manifold Security reports a fake Cloudflare verification ClickFix lure on third-party.com

    Initial Disclosure

    Manifold Security first reports malicious use of third-party.com after finding it in public AI skills and MCP server documentation, and BleepingComputer confirms the page shows a fake Cloudflare "Performing security verification" CAPTCHA that copies malicious PowerShell commands for Windows users.

    Show sources
    Open in new tab
  3. 02.05.2026 03:00 1 articles · 5mo ago

    PowerShell script from third-party.com downloads update2.zip payload

    Technical Analysis Update

    A Hybrid Analysis report dated May 2, 2026 shows third-party.com distributing a PowerShell script that downloads a 134MB archive from https://elxxvvx[.]xyz/update2.zip, saves it as update26.zip, extracts it, and attempts to launch draw.io.exe.

    Show sources
    Open in new tab