Threat Intel
Unreserved Documentation Domain third-party[.]com Hijacked to Deliver ClickFix Malware
The unreserved domain third-party[.]com, historically used as a documentation placeholder, has been acquired by threat actors to deliver ClickFix social engineering attacks targeting Windows users. Found hardcoded across more than 1,700 public repositories, the domain utilizes clipboard hijacking to execute malicious PowerShell payloads via the Windows Run dialog. Defenders must audit internal codebases and documentation for references to the compromised domain.
What Happened
The domain third-party[.]com, long utilized as a generic documentation placeholder similar to example.com, was left unreserved by IANA and has been registered by threat actors. Active since at least June 2026, the compromised domain has been repurposed to serve browser-based social engineering lures to Windows visitors while returning errors to non-Windows users. An analysis of public code repositories reveals that the domain is hardcoded across more than 1,700 projects, including AI agent configurations and documentation files.
Attack Vector and Mechanics
When Windows users navigate to a resource referencing the domain, they are presented with a fraudulent verification prompt mimicking a Cloudflare check. The campaign employs a ClickFix and pastejacking technique:
- The browser's clipboard is poisoned with a hidden, obfuscated command string.
- The user is instructed to resolve a pseudo-error or verification step by opening the Windows Run dialog, pasting the contents, and executing the command.
- The payload initiates a remote PowerShell script designed to download and execute secondary malware stages on the endpoint.
Impact
Because the domain was treated as a safe documentation placeholder across numerous open-source projects, developer tools, and internal scripts, engineers and administrators following standard integration guides are directly exposed to drive-by exploitation. Google Safe Browsing and VirusTotal currently flag the domain as malicious, though historical references inside codebases remain a persistent vector for credential and system compromise.
What Defenders Should Do
SecOps and sysadmins must immediately identify and remediate exposure points within their infrastructure:
- Scan internal source code repositories, configuration files, and documentation for hardcoded references to third-party[.]com.
- Block network traffic to third-party[.]com at the proxy and DNS level.
- Review endpoint detection and response (EDR) telemetry for anomalous PowerShell executions spawned from the Windows Run dialog (explorer.exe).
- Educate engineering teams on the risks of utilizing unreserved domain names as code placeholders.
Related articles
Brevo Supply‑Chain Breach: Cloudflare Key Theft Fuels ClickFix Malware Injection
Brevo’s hard‑coded Cloudflare API key fell into attackers’ hands, enabling a malicious Cloudflare Worker that ran for over five hours on September 14. The worker injected ClickFix scripts into Brevo’s own sites and the JavaScript libraries customers embed on their pages, distributing a backdoor WordPress plugin and other malware. Affected sites include brevo.com, sendinblue.com, and several customer‑facing URLs. Brevo quickly revoked the key, removed the Worker, and purged edge caches, but up to 100 000 third‑party sites may have been compromised. The incident underscores the risk of embedding
Read briefing
Group-IB Launches Detailed Malware Reports for SOC Analysts, Threat Hunters, and Reverse Engineers
Group-IB now publishes comprehensive Malware Reports that deliver actionable intelligence for security operations teams. The reports cover malware families, indicators, and remediation guidance, enabling faster detection and response. Defenders should integrate these reports into their SIEM, threat hunting workflows, and reverse‑engineering processes to improve coverage.
Read briefing
TONResolver RAT Targets Japanese Hospitality Sector via Booking.com Phishing
A targeted phishing campaign observed in May 2026 deployed the TONResolver RAT against hotels and accommodation providers in Japan. Threat actors utilized Booking.com-themed lures to deliver the malware, which uniquely abuses the TON blockchain for command-and-control operations.
Read briefing
Mac Malware Uses Fake CAPTCHA to Steal Keychain Credentials and Drain Crypto Wallets
A Go‑based malware delivered via a ClickFix phishing scam infected macOS systems by executing a terminal command. The payload extracts Keychain passwords and drains cryptocurrency wallets. Defenders should block the malicious domain, update EDR signatures, and audit Keychain access logs.
Read briefing