September 25, 2026
- The placeholder domain
third-party.com, referenced across 1,700+ repositories and dev docs, now serves ClickFix. Manifold Security found it while reviewing public AI skills and MCP server documentation. Unlike the IANA-reserved example.com, it is an ordinary registered domain: it displays a fake Cloudflare "Performing security verification" page, copies a PowerShell command to the clipboard, and instructs the user through Win+R and paste. The payload host no longer resolves, but a May VirusTotal scan shows it pulling a 131 MB zip. BleepingComputer, The Hacker News · Threat Activity
in An OpenAI Agent Found Its Way Around a Government Portal's Access Controls