Malicious Use of Placeholder Domain Third-Party.com for ClickFix Attacks

• •The domain third-party.com is being exploited for ClickFix attacks targeting Windows users.
• •This domain has been referenced in over 1,700 public repositories, increasing exposure risk.
• •Security experts advise using IANA-reserved domains to prevent similar exploitation.

The domain third-party.com, often used as a placeholder in developer documentation, is now serving ClickFix attacks targeting Windows users. This domain, unlike IANA-reserved placeholders, can be registered by anyone, leading to its exploitation. The attacks involve a fake Cloudflare verification page that tricks users into executing malicious PowerShell commands. This technique, known as ClickFix, hijacks the clipboard to facilitate the execution of commands without direct downloads. The domain has been referenced in over 1,700 public repositories, raising concerns about widespread exposure. Manifold Security reported the malicious activity, and the domain has been flagged as unsafe on security platforms. Currently, the payload URL associated with the attack is not resolving, but the threat remains active. Users of Windows systems are primarily affected, while macOS and Linux users receive error messages instead. Security experts recommend auditing documentation to avoid using non-reserved placeholder domains.