T1204.004

Placeholder domain used in dev docs now serves ClickFix attacks

The normally registered third-party.com domain is serving a fake Cloudflare verification page that uses a ClickFix technique to trick Windows users into running a PowerShell comma…

Sep 23, 2026