Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content

This is a clever supply chain attack vector targeting developers and documentation consumers.

The domain third-party[.]com, historically a benign placeholder in documentation (similar to example.com), has been weaponized. It now serves a ClickFix payload—a social engineering technique that tricks users into copying and pasting malicious PowerShell commands under the guise of a browser error or update. The attack is geo-fenced or user-agent filtered, showing a harmless decoy to non-Windows users while targeting Windows browsers with the malicious lure.

Technical Breakdown: – TTPs: T1204.002 (User Execution: Malicious File), T1566.002 (Phishing: Spearphishing Link), T1059.001 (Command and Scripting Interpreter: PowerShell). – Scope: Referenced in over 1,700 repositories across GitHub and other code hosts. This is a massive trust-bomb waiting to go off for anyone who blindly follows documentation links. – IOCs: third-party[.]com (domain). No specific IPs or hashes provided in the report yet—likely dynamic.

Defense: – Immediate: Block third-party[.]com at the proxy/DNS level. Treat it as a known malicious domain. – Proactive: Audit any internal documentation, README files, or code comments that reference this domain. Assume any developer who visited it on a Windows machine may be compromised. – User Education: Reinforce that no legitimate website will ever ask you to open a Run dialog and paste a command to "fix" a browser issue.

Source: https://thehackernews.com/2026/09/placeholder-third-partycom-referenced.html