Documentation Placeholder Domain third-party.com Hijacked to Deliver ClickFix Malware
The domain third-party.com, long used as a generic placeholder in documentation, has been observed serving a ClickFix lure to Windows browsers while showing a harmless decoy to other users. Manifold Security's Head of Research, Ax Sharma, noted that unlike example.com, third-party.com was not properly secured. The malicious activity affects over 1,700 repositories that reference the domain.
The compromise of third-party.com highlights a quiet but dangerous corner of the software supply chain: documentation itself. For years, developers have copied placeholder domains like third-party.com into code comments, API references, and configuration examples without a second thought. Because the domain was never locked down the way example.com was, an attacker was able to seize control and weaponize it. Now, any developer who follows outdated documentation and visits the domain on a Windows machine could be served a ClickFix prompt — a social engineering technique that tricks users into pasting a malicious command into their clipboard and executing it.
The scale of exposure is significant, with more than 1,700 repositories referencing the domain. This means the attack surface extends far beyond a single website, touching countless projects that trust the domain as a harmless illustration. The incident underscores how even the most mundane technical conventions can become vectors for compromise when left unguarded.
This incident could have a broad ripple effect across the software development community. Developers who encounter the compromised domain while following tutorials or reviewing legacy code may unknowingly expose themselves to malware, potentially leading to credential theft or system compromise. Organizations relying on internal documentation that references third-party.com could face similar risks. The attack may also erode trust in widely accepted placeholder conventions, prompting security teams to audit their own documentation for unverified external references. Ultimately, this serves as a reminder that security hygiene must extend to the most seemingly innocuous elements of the development ecosystem.