Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content
Summary: The domain third-party[.]com, long used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while showing a harmless decoy to other users, and has been flagged as malicious on VirusTotal and Google's Safe Browsing list. Manifold Security says the domain has been serving the lure since at least June 2026, poisoning the clipboard with a Cloudflare check that instructs victims to paste a command into the Windows Run dialog that extracts and runs a remote PowerShell payload, while macOS visitors see a message saying the site requires a Windows PC.
Bottom line: The domain is referenced in over 1,700 public GitHub repositories, including AI agent skills and MCP-server docs, so every one of those references now points at attacker infrastructure - and Manifold has since identified 13 more non-reserved placeholder domains, two of which serve scams and scareware and appear in hundreds of thousands of GitHub files.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026