Placeholder Domain "third‑party.com" Repurposed to Deliver Malware Across Thousands of Code Repositories

A domain that has long served as a generic placeholder in software documentation, third-party.com, is now being used to deliver malicious content. Security researchers have observed the site serving a ClickFix lure specifically to Windows browsers while showing a harmless decoy page to all other visitors, a tactic that allows the payload to evade casual inspection.

For years developers have copied snippets that reference third-party.com as an example URL in tutorials, configuration files and READMEs. Because the address is meant to be replaced before production, many projects leave it unchanged in public repositories, creating a wide surface area for abuse.

The current campaign exploits that habit. When a Windows user visits the domain, the site redirects to a ClickFix page that mimics a legitimate software update prompt, coaxing the victim into downloading and executing a malicious payload. Non‑Windows browsers receive a static page that appears innocuous, reducing the likelihood of detection by automated scanners.

Analysis of public code on platforms such as GitHub reveals the placeholder appearing in more than 1,700 repositories. In many cases the domain is embedded in scripts, Dockerfiles or configuration files that are later deployed without alteration, inadvertently exposing end users to the malicious redirect.

Supply‑chain attacks of this nature are increasingly common, as threat actors target the trust developers place in shared code. By compromising a seemingly harmless placeholder, attackers can reach a broad audience without needing to breach a specific target directly.

Security experts advise developers to audit their code for unresolved example URLs and replace them with domain names they control or with fully qualified, verified endpoints. Automated tools that flag external domains in production code can help catch such oversights before deployment.

The discovery has prompted a response from the open‑source community, with several maintainers issuing patches to remove or replace the placeholder. Ongoing monitoring of third-party.com traffic and broader awareness of placeholder abuse are expected to mitigate the immediate threat, but the episode underscores the need for stricter hygiene in code publishing practices.