Manifold Security researcher Ax Sharma has reported that the domain third-party[.]com, frequently used as a generic documentation placeholder across software projects, is being exploited by threat actors. The domain serves a ClickFix social engineering lure specifically to Windows browser users, while displaying a harmless decoy to other visitors. The domain's widespread use in approximately 1,700+ repositories has increased the likelihood of encounter by developers and researchers. No software patch is available for the domain itself; mitigation focuses on user awareness of ClickFix tactics.

What should defenders do?

Users should be cautious of unexpected prompts to run commands or scripts, especially when visiting documentation or placeholder domains. Security teams should review and, if necessary, update allowlists for placeholder domains. Educating developers and researchers about the risks of encountering such domains in their work is recommended. No patch is available for the domain itself, as the risk arises from its abuse.

highmalware

Placeholder Domain third-party[.]com Observed Serving ClickFix Lure to Windows Browsers

Security researchers warn that a commonly used documentation placeholder is being abused by threat actors to deliver social engineering attacks.

CyberIntel DeskPublished 4 days agoUpdated less than a minute ago1 min read

Placeholder Domain third-party[.]com Observed Serving ClickFix Lure to Windows Browsers

Key Takeaways

The domain third-party[.]com, a common documentation placeholder, is being abused to serve ClickFix lures.
Windows browser users are specifically targeted, while other users see a harmless decoy.
The domain's use across 1,700+ repositories increases exposure risk for developers and researchers.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read