Security1 publisher3 min readPublished
The documentation placeholder third-party.com has served a ClickFix lure to Windows visitors since June
Manifold Security found third-party.com, a placeholder in more than 1,700 public repositories, serving a ClickFix clipboard lure to Windows browsers since at least June 2026. Static scans of the same files come back clean, because the server chooses what to send.
The Watch · Security desk
What happened
- Manifold Security says third-party.com, a documentation placeholder for years, has been serving a ClickFix lure since at least June 2026, with harmless content shown to other visitors.
- Windows visitors get a fake Cloudflare check that poisons the clipboard and tells them to paste the command into the Run dialog, where it extracts and runs a remote PowerShell payload.
- A GitHub search finds the domain in more than 1,700 public repositories, including AI agent skill files and MCP-server documentation that cite it as an example endpoint.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Maintainers who hardcoded the string wrote a fetch instruction they never intended, and the request is made on the reader's or the agent's machine, not theirs.
- constraint Any review gate that judges a URL by the response it gets in a pipeline will approve these domains, because the server picks its answer per client.
- decision Teams choose now between combing docs, tests and skill files for plausible placeholder strings and finding out later which of the 11 quiet lookalikes starts answering.
- precedent This version of supply-chain delivery needs no compromise and no phishing infrastructure: registering a placeholder that thousands of files already trust is the whole setup.
A scanner that resolves third-party.com from a Linux analysis box gets a clean answer. A Windows browser following the same link out of an agent skill file gets a fake Cloudflare check and a clipboard rewritten with a command [1][6]. "A file scan cannot see what a website decides to send," Manifold Security said, and the behavior only appears at request time, for the caller the server chooses to serve [13].
The decoy states its own targeting. macOS visitors get a fake verification prompt reading "macOS is not supported. This website requires a Windows PC to access. Please try again from a Windows device." [7]. Check the link on a Mac and you see a refusal.
Ax Sharma, Manifold Security's Head of Research, said the string was never protected. third-party.com has been a generic documentation placeholder for years, he said, filling the same role example.com plays. Unlike example.com, he said, third-party.com is not IANA-reserved. Anyone could register it, and someone did, and every doc, test and skill that hard-coded it now points readers at attacker infrastructure, according to Sharma [2]
The repositories were using the string the way documentation has used it for years. In every one of those places it is exactly what it looks like, Sharma said: a placeholder, and entirely reasonable use by the teams involved. "It is also, now, a live pointer to a ClickFix server." [9] Because agent skills and MCP server documentation cite the domain as an example endpoint [8], Manifold said the weaponization also opens avenues for prompt injection and other unintended behavior [10].
Manifold's follow-on list names 13 further placeholder domains that are not IANA-reserved, among them acme.com, company.com, mycompany.com, vendor.com, myapp.com and foo.com [17]. Two of the 13 were caught serving content: yoursite.com and your-domain.com push scams and scareware to macOS visitors and an ordinary parking page to everyone else [14]. That leaves 11 on the list with no malicious response reported [1].
Researcher Cody Nash described what the two served. On a macOS browser, he said, your-domain.com showed a fake MacOS Security Center claiming four viruses and selling a counterfeit McAfee renewal at 55% off [15]. On another macOS render, Nash said, yoursite.com showed a counterfeit ZDF news article advertising an investment scheme [16]. Those two strings appear in hundreds of thousands of GitHub files and hundreds of agent skills [18]. "Scareware and investment fraud are a lower threat than clipboard malware, the exposure they ride on is far larger, and none of it showed up in any static check we ran," Nash said [19].
third-party.com is now flagged as malicious on VirusTotal and on Google's Safe Browsing list [3]. The advice from Manifold is to treat non-reserved placeholders such as yourcompany.com, mycompany.com and your-api.com as squattable [11], and to use only the reserved example.com, example.org and example.net in skills, docs and test cases [12].
What to watch
- Whether any of the 11 remaining non-reserved placeholders on Manifold's list, including acme.com, company.com and foo.com, begin serving content to a visitor class.
- Whether the PowerShell payload delivered to Windows visitors is attributed to a known ClickFix operator or access broker.
- Whether GitHub or code-scanning vendors start flagging non-reserved placeholder domains in repository content and agent skill files.