CYBERRAKSHAK LABS Β· RESEARCH #041

πŸ”΄ How a Developer Documentation Domain Is Now Being Used for ClickFix Attacks

When a harmless-looking documentation URL becomes live infrastructure, an old reference can turn into a modern malware delivery path.

By Vivek Kumar Β· Published 24 September 2026
RESEARCH#041
CATEGORYThreat Intelligence / ClickFix / AI & Developer Security
CRL ASSESSMENTHIGH
RESEARCH LEVELDeep Research
PUBLISHED2026-09-24
Source & social links: LinkedIn Post β†—WhatsApp β†—YouTube β†—
How CyberRakshakLabs researches threats β†’
A placeholder can become infrastructure. The supplied CyberRakshakLabs research describes a case where a normal registered domain used in developer-oriented documentation was serving a fake Cloudflare verification flow designed to persuade Windows users to execute PowerShell.
CLICKFIXThe user is manipulated into executing a command instead of simply downloading a file.
1,500+The supplied research attributes more than 1,500 file references across over 1,700 repositories to reporting by Manifold Security.
AI + MCPDocumentation, skills, repositories and external URLs can become trust dependencies for AI agents.
The Placeholder That Became a Malware Delivery Point

Developers often encounter domains inside documentation, examples and testing material and assume the URL is only illustrative. The supplied research emphasizes that browsers do not understand that intention: if a domain exists and someone controls its server, the browser connects to the live destination.

The research distinguishes genuinely reserved documentation domains such as example.com, example.net and example.org from a normal registered domain such as third-party.com.

According to the supplied article, BleepingComputer confirmed that third-party.com was serving a fake Cloudflare verification page using ClickFix to persuade Windows users to execute PowerShell.

The Attack Chain
Developer Documentation / AI Skill / MCP Documentation
↓
Live placeholder-style domain
↓
Fake Cloudflare Verification
↓
β€œVerify You Are Human”
↓
Malicious command copied to Clipboard
↓
Win + R β†’ Ctrl + V β†’ Enter
↓
PowerShell
↓
Remote Payload
↓
Potential Malware Infection

This is the ClickFix pattern described by the supplied research: the attacker manipulates the victim into performing the execution step themselves.

Why Trust Is the Real Attack Surface

The supplied research argues that the important issue is not only the fake CAPTCHA. It is the assumption that a domain appearing in trusted developer material must remain trustworthy.

References can appear in developer documentation, GitHub repositories, code examples, AI skills, MCP documentation and testing material. The reference may remain unchanged while the destination changes later.

The article attributes the finding about more than 1,500 files in over 1,700 repositories, including AI skills and MCP-related documentation, to Manifold Security. The supplied text explicitly notes that this does not mean those repositories were compromised; it demonstrates how widely the placeholder had propagated.

The AI / MCP Security Angle

AI agents increasingly read documentation, GitHub repositories, skills, MCP server instructions, configuration files and external URLs. The supplied research therefore treats a seemingly harmless URL as an external trust dependency.

What happens if an AI agent follows a URL whose owner or content changes later?

The underlying dependency problem is simple: the reference can stay the same while the destination changes.

What Developers Should Do
1. Use genuinely reserved domains
For documentation examples, use example.com, example.net and example.org.
2. Audit old documentation
Search repositories for third-party.com and other non-reserved placeholder domains.
3. Do not execute commands from webpages
A page instructing users to press Win+R and paste a command should be treated as suspicious.
4. Monitor ClickFix behaviour
SOC teams should investigate Browser β†’ PowerShell β†’ Network Connection β†’ Payload Download sequences.
5. Treat AI/MCP URLs as untrusted dependencies
Do not assume a URL is safe merely because it appears inside a trusted repository or AI skill.
Source discipline: This Research page is based on the supplied CyberRakshakLabs post. The post attributes specific observations to BleepingComputer, IANA and Manifold Security. CyberRakshakLabs does not independently verify those external reports on this page.
A trusted-looking URL is not the same thing as trusted infrastructure.

πŸ”₯ Final Takeaway

The code does not necessarily have to change. The documentation does not necessarily have to change. If the domain behind an old reference changes, the old reference can become an attack surface.

CyberRakshakLabs Awareness Rule: Treat external URLs in developer documentation, AI skills and MCP-related material as dependencies that require ongoing trust validation.