Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content
Squatted placeholder domain third-party.com now serves a Windows ClickFix lure referenced in over 1,700 repositories.
Manifold Security reports that third-party.com, a long-used documentation placeholder that is not IANA-reserved, has served a ClickFix lure to Windows browsers since at least June 2026 while showing a decoy or an unsupported-OS message to others. The page fakes a Cloudflare check, poisons the clipboard, and instructs the user to paste a command into the Windows Run dialog that fetches and runs a remote PowerShell payload. The domain appears in more than 1,700 public GitHub repositories, including AI agent skills and MCP server documentation, and is flagged by VirusTotal and Google Safe Browsing. Related placeholders yoursite.com and your-domain.com serve macOS scareware and investment-fraud pages and occur in far larger numbers of files.
- Non-reserved placeholder third-party.com has served a Windows ClickFix lure since June 2026.
- A fake Cloudflare check poisons the clipboard with a remote PowerShell command.
- More than 1,700 GitHub repositories, including agent skills, reference the domain.
- yoursite.com and your-domain.com serve macOS scareware and investment scams.
- Tags
- clickfixpastejackingsocial-engineeringpowershelldomain-squattingdocumentationsupply-chainagent-skills
- Products
- WindowsPowerShellmacOS
- Organizations
- Manifold SecurityGitHubGoogleVirusTotal
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | acme.com | .]com your-app[.]com yourapp[.]com myapp[.]com mysite[.]com acme[.]com company[.]com mycompany[.]com vendor[.]com foo[.]com To m |
| domain | company.com | app[.]com yourapp[.]com myapp[.]com mysite[.]com acme[.]com company[.]com mycompany[.]com vendor[.]com foo[.]com To make matters wo |
| domain | foo.com | .]com acme[.]com company[.]com mycompany[.]com vendor[.]com foo[.]com To make matters worse, the two scam-scarware-serving site |
| domain | myapp.com | your-site[.]com yoursite[.]com your-app[.]com yourapp[.]com myapp[.]com mysite[.]com acme[.]com company[.]com mycompany[.]com ven |
| domain | mycompany.com | non-reserved placeholder domains (e.g., yourcompany[.]com, mycompany[.]com, your-api[.]com, and their lookalikes) as squattable and |
| domain | mysite.com | com yoursite[.]com your-app[.]com yourapp[.]com myapp[.]com mysite[.]com acme[.]com company[.]com mycompany[.]com vendor[.]com foo |
| domain | third-party.com | The "third-party[.]com" domain, commonly used as a documentation placeholder, ha |
| domain | vendor.com | .]com mysite[.]com acme[.]com company[.]com mycompany[.]com vendor[.]com foo[.]com To make matters worse, the two scam-scarware-se |
| domain | your-api.com | ceholder domains (e.g., yourcompany[.]com, mycompany[.]com, your-api[.]com, and their lookalikes) as squattable and open to abuse by |
| domain | your-app.com | omain[.]com yourdomain[.]com your-site[.]com yoursite[.]com your-app[.]com yourapp[.]com myapp[.]com mysite[.]com acme[.]com company |
| domain | yourapp.com | rdomain[.]com your-site[.]com yoursite[.]com your-app[.]com yourapp[.]com myapp[.]com mysite[.]com acme[.]com company[.]com mycompa |
| domain | yourcompany.com | mentation and treat non-reserved placeholder domains (e.g., yourcompany[.]com, mycompany[.]com, your-api[.]com, and their lookalikes) a |
| domain | your-domain.com | re not IANA-reserved, with two of them – yoursite[.]com and your-domain[.]com – serving scams and scareware to macOS visitors and an or |
| domain | yourdomain.com | m are pass static checks, is as follows - your-domain[.]com yourdomain[.]com your-site[.]com yoursite[.]com your-app[.]com yourapp[.]c |
| domain | your-site.com | checks, is as follows - your-domain[.]com yourdomain[.]com your-site[.]com yoursite[.]com your-app[.]com yourapp[.]com myapp[.]com m |
| domain | yoursite.com | lder domains that are not IANA-reserved, with two of them – yoursite[.]com and your-domain[.]com – serving scams and scareware to ma |
From the original article
3 min read at thehackernews.com
The "third-party[.] com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. "third-party[.]
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.