Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content

Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content Ravie LakshmananSep 24, 2026Phishing / Malware The "third-party[.]com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. "third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays," Manifold Security's Head of Research, Ax Sharma, said. "Unlike 'example[.]com,' third-party[.]com is not IANA-reserved. Anyone could register it, and someone did. Every doc, test, and skill that hard-coded it now points readers at attacker infrastructure." As of writing, the domain has been marked as malicious and unsafe on both VirusTotal and Google's Safe Browsing list. ClickFix is a social engineering attack technique in…