The domain ‘third-party[.]com,’ traditionally used as a documentation placeholder, has recently been compromised to deliver harmful content to Windows users while presenting innocuous decoy pages to others. This domain, unlike the IANA-reserved ‘example.com,’ is not protected from registration, allowing malicious actors to exploit its widespread use in digital documentation.
Background on the Domain’s Misuse
According to Ax Sharma, Head of Research at Manifold Security, ‘third-party[.]com’ has served as a placeholder in various documents and tests. However, its lack of protection has led to its registration by an unknown entity, turning it into a potential threat vector. This has resulted in its listing as malicious on platforms like VirusTotal and Google’s Safe Browsing.
The exploitation involves a social engineering tactic known as ClickFix, which deceives users through error alerts or CAPTCHA prompts, leading them to execute harmful commands. This attack often hijacks the clipboard, injecting scripts that are later pasted into the Windows Run dialog or Terminal, a technique also referred to as pastejacking.
Impact on Developers and Repositories
Manifold Security reports that since June 2026, the domain has been used to deliver ClickFix attacks specifically targeting Windows users. This has resulted in a deceptive Cloudflare check that manipulates the victim’s clipboard, instructing them to paste and execute a command designed to initiate a remote PowerShell payload.
This domain appears in over 1,700 public repositories on GitHub, including those related to artificial intelligence and server documentation. Sharma emphasizes that while these references initially served as reasonable examples, they now inadvertently direct users to a malicious server.
Preventative Measures and Future Outlook
To mitigate this threat, it is recommended that developers audit their documentation and replace non-reserved placeholder domains with IANA-reserved ones such as ‘example.com.’ This practice can prevent potential misuse by threat actors who might register such domains to serve malicious content.
The discovery of additional non-IANA-reserved placeholder domains being used for scams and scareware further highlights the urgency of this issue. Some of these domains, like ‘your-domain[.]com’ and ‘yoursite[.]com,’ have been found to serve fraudulent content to macOS users, further complicating the threat landscape.
Manifold Security’s findings underscore the importance of vigilance in digital documentation practices. As cyber threats continue to evolve, ensuring the use of secure and reserved domains is crucial in safeguarding against potential exploits and protecting users from harm.
