{"id":3131,"date":"2026-09-24T17:06:56","date_gmt":"2026-09-24T17:06:56","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3131"},"modified":"2026-09-24T17:06:56","modified_gmt":"2026-09-24T17:06:56","slug":"placeholder-third-party-com-referenced-across-1700-repositories-now-serves-malicious-content","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3131","title":{"rendered":"Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content"},"content":{"rendered":"
\n
<\/a><\/div>\n

The \u00abthird-party[.]com\u00bb domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users.<\/p>\n

\u00abthird-party[.]com has been a generic documentation placeholder for years, the same role example.com plays,\u00bb Manifold Security’s Head of Research, Ax Sharma, said<\/a>. \u00abUnlike ‘example[.]com,’ third-party[.]com is not IANA-reserved<\/a>. Anyone could register it, and someone did. Every doc, test, and skill that hard-coded it now points readers at attacker infrastructure.\u00bb<\/p>\n

As of writing, the domain has been marked as malicious and unsafe on both VirusTotal<\/a> and Google’s Safe Browsing list<\/a>.<\/p>\n

ClickFix is a social engineering attack<\/a> technique in which either malicious or legitimate-but-compromised websites display error messages, browser alerts, or CAPTCHA verification prompts, tricking users into copying and executing hidden commands<\/a> via the Windows Run dialog or Terminal to \u00abfix\u00bb the issue.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Often, web pages using ClickFix rely on clipboard hijacking to automatically inject malicious script or commands into the victim’s clipboard for subsequent pasting on Windows Run dialog or macOS Terminal. This approach is also sometimes referred to as pastejacking.<\/p>\n

<\/p>\n

According to Manifold Security, the domain has been serving the ClickFix lure since at least June 2026. Windows users visiting the page are shown a Cloudflare check that poisons the victim’s clipboard and instructs them to paste and run the command via the Windows Run dialog. The pasted command is designed to extract and run a remote PowerShell payload.<\/p>\n

When a macOS user visits the same page, the fake security verification prompt shows an error: \u00abmacOS is not supported. This website requires a Windows PC to access. Please try again from a Windows device.\u00bb<\/p>\n

A search on GitHub shows that the domain is referenced<\/a> in over 1,700 public repositories, including those related to AI agent skills and MCP-server docs that cite \u00abthird-party[.]com\u00bb as an example endpoint.<\/p>\n

\"\"<\/a><\/div>\n

\u00abIn every one of those places it is exactly what it looks like: a placeholder, an example, a stand-in, and entirely reasonable use by the teams involved,\u00bb Sharma noted. \u00abIt is also, now, a live pointer to a ClickFix server.\u00bb<\/p>\n

This weaponization of a blindly trusted domain, in turn, can open up avenues<\/a> for prompt injection and other unintended behaviors.<\/p>\n

To counter the threat, it’s advised to audit their documentation and treat non-reserved placeholder domains (e.g., yourcompany[.]com, mycompany[.]com, your-api[.]com, and their lookalikes) as squattable and open to abuse by threat actors, who can register them and serve malicious content.<\/p>\n

Developers working on skills, documentation, or test cases are recommended to use reserved placeholders like \u00abexample[.]com\u00bb (or \u00abexample[.]org,\u00bb \u00abexample[.]net\u00bb) only and avoid using plausible-sounding domains that are not under their control.<\/p>\n

\u00abYou can scan the skill, read the file, resolve the domain from your analysis box, and conclude it is fine, and be completely wrong about what a Windows user’s agent receives when it follows the same link,\u00bb Manifold Security pointed out. \u00abA file scan cannot see what a website decides to send. The tell only appears at request time, from the caller that matters.\u00bb<\/p>\n

The disclosure comes as Manifold said it has since identified 13 more placeholder domains that are not IANA-reserved, with two of them \u2013 yoursite[.]com and your-domain[.]com \u2013 serving scams and scareware to macOS visitors and an ordinary parking page to other users.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abOn a macOS browser, your-domain[.]com showed a fake ‘MacOS Security Center’ claiming four viruses and selling a counterfeit McAfee renewal at 55% off,\u00bb security researcher Cody Nash said<\/a>. \u00abOn another macOS render, yoursite[.]com showed a counterfeit ZDF news article advertising an investment scheme.\u00bb<\/p>\n

The complete list of domains, each of them are pass static checks, is as follows –<\/p>\n