Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content
-
The third-party[.]com domain, long used as a generic documentation placeholder akin to example.com, has been observed serving malicious content to Windows users. According to Manifold Security's Head of Research, Ax Sharma, the domain has been referenced across more than 1,700 repositories, and it is now delivering a ClickFix lure to Windows browsers while showing a harmless decoy page to other visitors.
The key points from the research:
- third-party[.]com has served as a documentation placeholder for years, similar to the role example.com plays.
- The domain is referenced in over 1,700 repositories.
- Windows browsers are served a ClickFix lure, while other users see a benign decoy.
- The malicious behavior differs by platform, meaning only Windows visitors receive the lure.
Sharma noted that unlike example.com, third-party[.]com has now been weaponized, turning a trusted placeholder into a delivery mechanism for social engineering.
Source: [email protected] (The Hacker News)
Has your organization scanned its codebases or documentation for references to third-party[.]com, and if so, what did you find?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login