<![CDATA[Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content]]>The third-party[.]com domain, long used as a generic documentation placeholder akin to example.com, has been observed serving malicious content to Windows users. According to Manifold Security's Head of Research, Ax Sharma, the domain has been referenced across more than 1,700 repositories, and it is now delivering a ClickFix lure to Windows browsers while showing a harmless decoy page to other visitors.

The key points from the research:

  • third-party[.]com has served as a documentation placeholder for years, similar to the role example.com plays.
  • The domain is referenced in over 1,700 repositories.
  • Windows browsers are served a ClickFix lure, while other users see a benign decoy.
  • The malicious behavior differs by platform, meaning only Windows visitors receive the lure.

Sharma noted that unlike example.com, third-party[.]com has now been weaponized, turning a trusted placeholder into a delivery mechanism for social engineering.

Source: info@thehackernews.com (The Hacker News)

Has your organization scanned its codebases or documentation for references to third-party[.]com, and if so, what did you find?

]]>https://xploitlk.com/topic/457/placeholder-third-party-.-com-referenced-across-1-700-repositories-now-serves-malicious-contentRSS for NodeTue, 27 Oct 2026 08:56:24 GMTFri, 25 Sep 2026 04:30:20 GMT60