al-ice.ai

A Placeholder Domain in 1,700 Repos Started Serving ClickFix — Including to Agent Skills and MCP Docs

Agent & Supply Chain Security by al-ice.ai Editorial

For years, third-party[.]com played the same role in documentation that example.com plays: a generic stand-in for “some external website.” There is one difference, and it is now a live incident. example.com is IANA-reserved and can never be registered. third-party[.]com is an ordinary registrable domain — anyone could claim it, and someone did. Every doc, test fixture, and agent skill that hard-coded it now points its readers at attacker infrastructure.

Manifold Security’s head of research Ax Sharma disclosed the finding on September 24: the domain has been serving a ClickFix lure since at least June 2026. A GitHub search shows it referenced in more than 1,700 public repositories, including AI agent skills and MCP-server documentation that cite it as an example endpoint. As Sharma put it: in every one of those places it is exactly what it looks like — a placeholder, an entirely reasonable choice by the teams involved — and it is also now a live pointer to a ClickFix server. The domain has since been flagged as malicious on VirusTotal and in Google Safe Browsing.

What visitors get

The payload is OS-aware. Windows visitors see a fake Cloudflare “Performing security verification” check; clicking “Verify you are human” copies a malicious PowerShell command into the clipboard, then instructs the victim to press Win+R, paste, and hit Enter. BleepingComputer confirmed the pasted command reconstructs a payload URL (elxxvvx[.]xyz/f), downloads a remote PowerShell script, and executes it. macOS visitors get a decoy instead — an error claiming macOS is unsupported and demanding a Windows device.

That split matters for detection: the malicious behavior is served selectively, at request time, to the caller that matters. A scanner fetching the page from a Linux analysis box sees the harmless branch and concludes the domain is fine.

Why this is an agent-security story, not just a docs-hygiene story

Manifold found the domain while examining public AI skills and MCP-server documentation — the references live inside the material agents consume as configuration. A skill file that names third-party[.]com as an example endpoint is, from the agent’s perspective, a trusted instruction pointing at a URL. When the agent follows it on a Windows host, the “documentation” resolves to a clipboard-poisoning page. Manifold’s warning is blunt and worth quoting in full: you can scan the skill, read the file, resolve the domain from your analysis box, and conclude it is fine — and be completely wrong about what a Windows user’s agent receives when it follows the same link. A file scan cannot see what a website decides to send.

The same mechanism opens a prompt-injection avenue: a squatted placeholder inside skill or MCP documentation is a position from which an attacker can serve arbitrary content — instructions, lures, or exploit pages — to any agent or user that treats the docs as trustworthy. This is the repository-borne trust problem wearing a DNS costume, and it composes uncomfortably with the Plugin4Shell class of zero-click agent supply-chain flaws: trusted agent inputs that resolve, at runtime, to someone else’s infrastructure.

Thirteen more, and two already monetizing

Manifold identified 13 additional non-reserved placeholder domains in the same role: your-domain[.]com, yourdomain[.]com, your-site[.]com, yoursite[.]com, your-app[.]com, yourapp[.]com, myapp[.]com, mysite[.]com, acme[.]com, company[.]com, mycompany[.]com, vendor[.]com, and foo[.]com. Two of them — yoursite[.]com and your-domain[.]com — are already serving scams and scareware to macOS visitors (a fake “MacOS Security Center” pushing a counterfeit McAfee renewal at 55% off; a counterfeit news article advertising an investment scheme) while showing an ordinary parking page to everyone else.

The exposure behind those two is far larger than the ClickFix domain: researcher Cody Nash reports they appear in hundreds of thousands of GitHub files and hundreds of agent skills. None of it tripped any static check Manifold ran — because statically, there is nothing to trip on. A string like vendor[.]com in a doc is indistinguishable from legitimate prose until the day the domain’s owner changes the response.

What to do

  • Use only IANA-reserved placeholders — example.com, example.org, example.net — in skills, docs, tests, and fixtures. Never use plausible-sounding domains you do not control.
  • Grep your own estate for the 14 domains — skills, MCP configs, docs, test fixtures, and example environment files. Every hit is a pointer you do not control.
  • Treat non-reserved placeholders as squattable. yourcompany[.]com, mycompany[.]com, your-api[.]com and lookalikes are all claimable; audit them the way you would any other third-party dependency.
  • Move agent URL trust to request time. Static allow-review of a skill file is insufficient for domains whose content is attacker-controlled. Resolve, fetch, and classify from an execution context that matches the real caller — OS, headers, and all — and re-check on a schedule, not just at install.
  • Block the known-malicious indicators at proxy and endpoint layers, and hunt for Win+R / clipboard-paste executions that may predate the flagging — the lure has been live since at least June.

The uncomfortable generalization: documentation is now agent configuration, and configuration that contains URLs is a dependency manifest. A placeholder is a dependency you never pinned, on infrastructure you never chose, owned by whoever renews the registration this year. Audit it like one.

Sources: