[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2di2ae4MTid_Nhus1ftOs7GIOkonnQHdes9DL8ljn3E":3},{"article":4,"iocs":47,"watch_terms":57,"solutions":58,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"0f125269-9074-49bb-bf98-2f28a90d29ac","Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content","placeholder-third-party-com-referenced-across-1-700-repositories-now-serves-mali-e32e04","The \"third-party[.]com\" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. \"third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays,\" Manifold Security's Head of Research, Ax Sharma, said. \"Unlike 'example[.]com,' third-party[.]com","The domain 'third-party[.]com', historically used as a placeholder in documentation and code, has been weaponized to serve malicious content. It now redirects Windows users to a ClickFix lure designed to execute PowerShell payloads, while macOS users see a fake security alert. This highlights the risk of using non-reserved domains as placeholders, as they can be registered by attackers.","Placeholder domain 'third-party[.]com' now serves malicious ClickFix lures.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fplaceholder-third-partycom-referenced.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhy4aXDWSC5cKzOZO8lRbk8o5I1fHPlCGbfxxYL6tyJxauEL-8EVj7-AypDhYt_Wg6bDLqlj0UK4LrGJdeI4ChsksaB6tTZxo8ikCLdwC0wjRfJPE_Z1qM_CVUg7s1ORdmWW2XTDtlPPDcI8JvelrbmJhcjVthnqYWQrZ7ySnIMMPRZfa_VzgaBCWyWc_JJ\u002Fs1600\u002Fthird.jpg","2026-09-24T15:27:32+00:00","2026-09-24T20:01:05.33313+00:00",8,[17,20,23,26],{"name":18,"type":19},"Cloudflare","product",{"name":21,"type":22},"Manifold Security","vendor",{"name":24,"type":25},"PowerShell","technology",{"name":27,"type":28},"ClickFix","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52,55],{"type":49,"value":50,"context":51},"domain","third-party[.]com","Malicious domain serving ClickFix lure and decoy content.",{"type":49,"value":53,"context":54},"your-domain[.]com","Placeholder domain serving scams and scareware on macOS.",{"type":49,"value":56,"context":54},"yoursite[.]com",[21,18],{"controls":59,"vendors":143},[60,88,117],{"slug":46,"name":61,"problem":62,"products":63},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":89,"name":90,"problem":91,"products":92},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"slug":118,"name":119,"problem":120,"products":121},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[122,128,136],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":123,"product_name":124,"url":126,"description":127},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":118,"product_name":140,"url":141,"description":142},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":161},"placeholder-domain-hijacked-to-serve-malware-across-1700-repos","Placeholder Domain Hijacked to Serve Malware Across 1,700+ Repos","Developers routinely used 'third-party[.]com' as a throwaway placeholder in documentation and code without verifying it was a reserved or controlled domain, leaving it open for a malicious actor to register and weaponize it. Once acquired, the attacker configured the domain to serve targeted payloads — ClickFix PowerShell lures for Windows users and fake security alerts for macOS users — exploiting the implicit trust that exists when a domain appears in widely-used repositories. This attack demonstrates that placeholder or example domains embedded in real codebases create a latent supply chain risk that can be triggered years later when an attacker registers the domain. The scale of 1,700+ affected repositories amplifies the blast radius, as any developer, CI\u002FCD pipeline, or end-user system that resolves this domain is now exposed.",[149,150,151,152,153,154,155,156,157,158,159,160],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 16: Application Software Security","NIST SP 800-53 CM-2: Baseline Configuration","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-218 SSDF PW.5: Reuse Existing, Well-Secured Software","RFC 2606: Reserved Top Level DNS Names (IANA Example Domains)","NIST CSF ID.AM-2: Software platforms and applications inventoried","NIST CSF DE.CM-1: Network monitoring to detect cybersecurity events","OWASP Dependency-Track (SCA tooling for supply chain risk)",{"NIST SP 800-53 CM-7: Least Functionality":162,"NIST SP 800-53 CM-2: Baseline Configuration":163,"CIS Control 16: Application Software Security":164,"NIST SP 800-53 SA-12: Supply Chain Protection":165,"CIS Control 9: Email and Web Browser Protections":166,"CIS Control 2: Inventory and Control of Software Assets":167,"OWASP Dependency-Track (SCA tooling for supply chain risk)":168,"RFC 2606: Reserved Top Level DNS Names (IANA Example Domains)":169,"NIST SP 800-218 SSDF PW.5: Reuse Existing, Well-Secured Software":170,"NIST CSF ID.AM-2: Software platforms and applications inventoried":171,"NIST CSF DE.CM-1: Network monitoring to detect cybersecurity events":172,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":173},"Requires least functionality, such as removing sample code that fetches content from placeholder domains.","Requires a reviewed baseline configuration, which would flag references to external domains the organisation does not control.","Asks for secure development, including review that catches placeholder domains left in code and documentation.","Requires supply chain protection, covering code and documentation that point to third party domains.","Asks for DNS and web filtering, which can block calls to a newly malicious domain like third-party[.]com.","Asks for knowing the software and dependencies you use, which would reveal code pulling from the hijacked placeholder domain.","Provides software composition analysis, helping identify dependencies and components that reference risky external sources.","Reserves example.com and similar names for documentation, the safe alternative to third-party[.]com that would have avoided the hijack.","Asks that reused code is well secured, which excludes snippets pointing at unregistered placeholder domains.","Asks for inventorying software and applications, helping find the 1,700+ repositories that referenced the domain.","Asks for network monitoring, which can detect traffic to the hijacked domain serving malware.","Asks for secure configuration, such as never shipping code or settings that reference uncontrolled domains."]