> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content - URL: https://f4n6.co.uk/security-feed/placeholder-third-party-com-referenced-across-1-700-repositories-now-serves-malicious-content/ - Published: 2026-09-24T18:32:15.000Z - Updated: 2026-09-24T18:32:15.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary The domain third-party\[.\]com, a non-IANA-reserved string widely used as a documentation placeholder, has been registered by an unidentified party and now serves a ClickFix clipboard-hijacking lure to Windows browsers while returning a harmless decoy to other visitors. Manifold Security reports the lure has been live since at least June 2026, and the domain is currently flagged as malicious by VirusTotal and Google Safe Browsing. The exposure is not a software vulnerability: no CVE, CVSS score or CISA KEV entry applies, and no threat actor has been named or attributed. The risk sits in client-controlled artefacts, with the domain hard-coded in more than 1,700 public GitHub repositories including AI agent skills and MCP server documentation, so any developer, test pipeline or autonomous agent that resolves it reaches attacker infrastructure. Manifold also lists 13 further non-reserved placeholder domains, two of which serve macOS scareware and investment fraud; that set is single-sourced and should be verified before enforcement. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | NIS2 Art. 21(2)(d): supply chain security measures | Client-controlled repositories, documentation, test cases and AI agent or MCP server configurations hard-code third-party\[.\]com, a non-reserved domain now under third-party control and serving malicious content | Treats the hard-coded reference as a supply chain security defect in your own artefacts. Requires an inventory of non-reserved placeholder domains across code, docs and agent skills, and a control that prevents new ones entering the repository. Applies to entities in scope of NIS2. | No DORA article is directly engaged. DORA Art. 17, 18 and 19 attach to an ICT-related incident at the entity, and no client incident is confirmed here: the exposure is a latent reference to attacker-controlled infrastructure, not a reported disruption. DORA Art. 28 concerns ICT third-party providers under contract, and a squatted placeholder domain is not a contracted provider. If a client confirms that a user or agent executed the pasted command, the incident-management and classification articles become relevant at that point, and the assessment should be revisited. ## 3\. Technical analysis & attack chain The operation is domain squatting combined with a ClickFix social engineering page. The domain is not reserved by IANA, so it was available for registration; the source does not state who registered it, when, or for how long. Manifold Security's Head of Research Ax Sharma notes that unlike example\[.\]com, third-party\[.\]com was never protected, and that every document, test and skill hard-coding it now points readers at attacker infrastructure. Confirmed steps, as described by Manifold Security: 1. A user, build process or AI agent resolves third-party\[.\]com from a hard-coded reference in documentation, a test case, an AI agent skill or an MCP server configuration. 2. The server fingerprints the requesting client. Windows browsers receive a fake Cloudflare verification check; other clients receive a harmless decoy page. 3. The fake check poisons the visitor's clipboard with a command and instructs them to paste it into the Windows Run dialog. 4. The pasted command extracts and runs a remote PowerShell payload on the Windows host. 5. macOS visitors receive no lure. The fake verification prompt returns the error: "macOS is not supported. This website requires a Windows PC to access. Please try again from a Windows device." ClickFix, also called pastejacking, is the technique class here. The page does not exploit a browser or Windows flaw. It relies on the user performing the final step, pasting attacker-supplied text into the Run dialog or Terminal, which is why the payload executes outside the browser sandbox and outside the reach of any control that inspects the page itself. Sharma's point is the operationally important one: a file scan, a static review of the skill, or a resolution check from an analysis host all return a clean result, because the malicious response is only produced for the caller the server decides to target. The source does not publish the clipboard command text, the PowerShell payload, any command-and-control address, any payload hash, or any persistence, privilege escalation or lateral movement behaviour. Nothing in the material indicates ransomware, data theft or extortion, and no such claim should be inferred. Two claims are single-sourced and carry lower confidence. First, the June 2026 start date and the full mechanics above rest on Manifold Security's reporting alone; the VirusTotal and Safe Browsing listings corroborate that the domain is currently considered malicious, not the timeline or the page behaviour. Second, the assessment that this "can open up avenues for prompt injection and other unintended behaviors" is Manifold's forward-looking concern about agents that follow links in skills and documentation. It is plausible and worth designing against, but no prompt injection technique, payload or observed agent compromise is described. Treat it as a hypothesis, not a finding. Manifold states it has identified 13 additional non-reserved placeholder domains that pass static checks. Four are named in the source: your-domain\[.\]com, yourdomain\[.\]com, your-site\[.\]com and yoursite\[.\]com. The published list is truncated after a fifth entry beginning "you", so the remaining names are not available. Two of the named domains serve different content by platform: your-domain\[.\]com showed a macOS visitor a fake "MacOS Security Center" claiming four viruses and selling a counterfeit McAfee renewal at 55 percent off, while yoursite\[.\]com showed a counterfeit ZDF news article advertising an investment scheme. Both were reported by researcher Cody Nash. Other visitors to those two domains saw an ordinary parking page. This entire set is single-sourced to Manifold Security; verify each domain independently before adding it to a blocklist or acting on it in production. ## 4\. Mitigation & containment P1 (within 24 hours) - Block resolution and egress to third-party\[.\]com at DNS resolvers, secure web gateways and forward proxies. This is the only domain in the item with independent corroboration of maliciousness (VirusTotal and Google Safe Browsing listings alongside Manifold's report). - Search source control, documentation, wikis and configuration for the string third-party\[.\]com, including in AI agent skill files and MCP server definitions. Run it across all branches and history, not just the default branch: `git grep -I "third-party.com" $(git rev-list --all)` or the equivalent full-history search in your platform. - Hunt for execution. The source describes a Run dialog paste that retrieves and runs a remote PowerShell payload, so look for powershell.exe with explorer.exe as parent process, and for powershell.exe command lines containing remote retrieval or encoded content, in EDR telemetry covering the period since June 2026\. The source does not publish the command text, so this is a behavioural hunt, not a signature match. - Check whether any autonomous agent, CI job or documentation build resolves external links from skills or docs, and identify which of those have egress to the internet. P2 (within 72 hours) - Replace every hit with a reserved placeholder: example\[.\]com, example\[.\]org or example\[.\]net. Do not substitute another plausible-sounding domain that the organisation does not control. - Audit for the other named placeholders (your-domain\[.\]com, yourdomain\[.\]com, your-site\[.\]com, yoursite\[.\]com) and for the wider pattern of yourcompany\[.\]com, mycompany\[.\]com and your-api\[.\]com style strings. Verify each against current reputation sources before blocking; the list is single-sourced. - Add an egress policy for agent runtimes and build workers that restricts outbound resolution to an allowlist, so a hard-coded placeholder cannot reach a live host from an automated context. - Brief service desk and end users on ClickFix: a Cloudflare-style verification page that asks you to open the Run dialog and paste a command is never legitimate, and no verification check requires clipboard content to be executed. P3 (within 7 days) - Add a CI or pre-commit check that fails on non-reserved placeholder domains in code, docs and skill files, with example\[.\]com, example\[.\]org and example\[.\]net as the only permitted stand-ins. - Extend the same check to MCP server manifests and agent skill registries, which the source identifies as a significant share of the 1,700+ affected repositories. - Review whether any internal documentation or test fixture references a domain the organisation does not own, and register or retire those names. ## 5\. Indicators of compromise | type | value | confidence | source | | ------ | ------------------- | ---------- | ----------------------------------------------------------------------------------------- | | domain | third-party\[.\]com | high | Manifold Security; corroborated by VirusTotal and Google Safe Browsing malicious listings | | domain | your-domain\[.\]com | low | Manifold Security (single source) | | domain | yourdomain\[.\]com | low | Manifold Security (single source) | | domain | your-site\[.\]com | low | Manifold Security (single source) | | domain | yoursite\[.\]com | low | Manifold Security (single source) | No file hashes, IP addresses, file paths, registry keys, mutexes or command-and-control addresses are present in the source material. The clipboard command and the PowerShell payload are described but not published. ```iocs domain third-party[.]com domain your-domain[.]com domain yourdomain[.]com domain your-site[.]com domain yoursite[.]com ``` Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | HTTP response to a Windows browser user agent returning a fake Cloudflare verification page that instructs the visitor to paste a command into the Run dialog | secure web gateway or proxy logs with response body capture; browser history | medium (single source) | | Clipboard content replaced with an executable command on page load | EDR clipboard telemetry, where collected | medium (single source) | | powershell.exe spawned with explorer.exe as parent, retrieving and running a remote payload | EDR process telemetry | medium (single source, mechanism described but command text not published) | | Page content containing the string "macOS is not supported. This website requires a Windows PC to access. Please try again from a Windows device." returned to macOS user agents | proxy response body capture; saved page content | medium (single source) | | Identical URL returning a benign decoy page to non-Windows user agents | proxy response body capture, compared across user agents | medium (single source) | ## 6\. Detection The YARA rule below targets saved HTML, cached page content and web artefacts rather than executables, because the source publishes page text and no binary indicators. The Sigma rule covers DNS resolution of the placeholder domains and should be adapted to proxy logs where a URI field is available. ```yara rule ClickFix_Placeholder_Domain_Lure_Page { meta: author = "Adverse Trace" date = "2026-09-24" reference = "https://thehackernews.com/2026/09/placeholder-third-partycom-referenced.html" description = "Matches saved HTML or cached page content from the ClickFix lure served by third-party[.]com and the placeholder-domain scam pages reported alongside it" strings: $a = "macOS is not supported. This website requires a Windows PC to access. Please try again from a Windows device." ascii wide $b = "MacOS Security Center" ascii wide $c = "third-party.com" ascii wide condition: 2 of them } ``` ```yaml title: Resolution of Non-Reserved Placeholder Domain Serving ClickFix Lure id: 8f2c1d64-3a71-4b90-9e5c-6d0a7f41b2c8 status: experimental description: Detects DNS resolution of third-party[.]com and the non-reserved placeholder domains reported alongside it. Adapt to proxy or web gateway logs by matching the request URI host where DNS telemetry is unavailable. author: Adverse Trace date: 2026/09/24 references: - https://thehackernews.com/2026/09/placeholder-third-partycom-referenced.html logsource: category: dns_query product: windows detection: selection_domain: QueryName|endswith: - 'third-party.com' - 'your-domain.com' - 'yourdomain.com' - 'your-site.com' - 'yoursite.com' condition: selection_domain falsepositives: - Documentation builds, test suites and developer tooling that resolve the placeholder domain by design - Repositories and skills that have not yet replaced the placeholder string level: medium ``` ## 7\. Sources - The Hacker News, "Placeholder third-party\[.\]com Referenced Across 1,700+ Repositories Now Serves Malicious Content", https://thehackernews.com/2026/09/placeholder-third-partycom-referenced.html, 2026-09-24\. Reporting Manifold Security research (Ax Sharma) and researcher Cody Nash. ## 8\. Adverse Trace position We assess this as a moderate, non-urgent exposure for most EMEA financial services clients and an elevated one for any organisation whose repositories, documentation or AI agent skills reference third-party\[.\]com or the other named placeholder domains. There is no CVE, no CVSS score and no CISA KEV entry, because the technique exploits user trust and clipboard behaviour rather than a software flaw, and no actor has been named, so we make no attribution. The domain-level indicator is corroborated by VirusTotal and Google Safe Browsing; the June 2026 timeline, the page mechanics and the wider list of 13 placeholder domains rest on Manifold Security alone and should be verified before enforcement. We will monitor for publication of the clipboard command, the PowerShell payload or any command-and-control infrastructure, and will issue an update if a client confirms execution of the pasted command, which would move this from a hygiene finding to a reportable incident. Clients who want the repository and agent-skill audit run against their own estate should contact their Adverse Trace handler. --- [Read the original source →](https://thehackernews.com/2026/09/placeholder-third-partycom-referenced.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*