Non-IANA Placeholder third-party.com Delivers ClickFix to 1,700+ GitHub Repos Since June 2026
A single unregistered placeholder domain now routes 1,700+ codebases to live ClickFix infrastructure. The attack succeeds because documentation examples are treated as static text rather than resolvable endpoints. Two additional squatted domains already deliver platform-specific scams, confirming the pattern is repeatable.
Manifold Security telemetry shows the domain began ClickFix delivery no later than June 2026. Windows visitors receive a Cloudflare interstitial that poisons the clipboard with a PowerShell downloader command; macOS visitors see an explicit unsupported-platform message. Static scanners and file-based reviews miss the conditional payload because the malicious branch executes only on the live request from a Windows user agent. GitHub search confirms references across AI agent skill definitions and MCP-server documentation that treat the string as inert example text. The pattern extends beyond one domain: Manifold identified 13 additional non-reserved placeholders, two of which already serve macOS-specific scareware and investment scams. Reserved IANA domains such as example.com remain safe because they cannot be registered by adversaries. Developers who hard-code plausible-sounding strings create persistent, unmonitored pointers into attacker infrastructure that only surface at runtime. Contract and procurement reviews of internal tooling should now include placeholder-domain inventories, not merely dependency lists. Without such audits, documentation updates become silent supply-chain vectors that bypass both SBOM and code-scanning controls.
Manifold Security: VirusTotal will flag at least three more of the listed non-reserved domains as malicious within 45 days.
Sources (2)
- [1]Manifold Security Disclosure(https://manifold.security/research/placeholder-domains-2026)
- [2]The Hacker News Report(https://thehackernews.com/2026/09/placeholder-third-partycom-referenced.html)