Loading story…
Researchers found that registrable domains commonly used as documentation placeholders—including yoursite.com, your-domain.com, and third-party.com—have been operated as malicious infrastructure. Manifold Security reported that the first two domains appear in roughly 359,000 GitHub files and 349 AI-agent skills; browser testing showed JavaScript-driven, cloaked redirect chains affecting tested macOS sessions, including fake security alerts leading through affiliate infrastructure and fraudulent investment pages. The abuse evaded static reputation and registry checks because final destinations were assembled at runtime in a real browser.
Separately, third-party.com, long used as a development-documentation example, was reported as infrastructure for a ClickFix attack. The incidents demonstrate that examples using registrable domains can become dangerous without any change to the original code, skill, or documentation. Organizations should inventory documentation, repositories, AI-agent skills, and user guidance for non-reserved placeholder domains, replace them with IANA-reserved names such as example.com and example.org, and treat visits to legacy example links as potentially untrusted.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Manifold Security disclosed that the unreserved documentation placeholder domain third-party.com had been repurposed to target Windows users with a ClickFix lure. The fake verification page copied a PowerShell command to victims' clipboards and directed them to paste it into the Windows Run dialog.
Manifold Security reported that unreserved placeholder domains yoursite.com and your-domain.com, cited in about 359,000 GitHub files and 349 AI-agent skills, served cloaked scam redirect chains in real-browser testing. Observed macOS flows included a fake security alert leading through affiliate infrastructure and fraudulent news pages promoting investment schemes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The registrant-controlled `third-party[.]com` domain, widely used as a placeholder in developer documentation, is serving a Windows-targeted ClickFix lure disguised as a Cloudflare verification page. Windows visitors are instructed to paste and run a clipboard-poisoned PowerShell command that reconstructs a URL at `elxxvvx[.]xyz` and retrieves a second-stage script; analysis indicates the script downloaded an archive and attempted to execute `draw.io.exe`. The site has delivered the malicious workflow since at least June 2026, while macOS and Linux visitors receive error messages or benign content. More than 1,700 public GitHub repositories reference the domain, including AI-agent skill and MCP-server documentation, creating a risk that users may follow a formerly innocuous example link into the attack flow. There is no evidence that repositories containing the placeholder were compromised or that copied links have resulted in confirmed executions. Researchers also identified 13 other non-reserved placeholder domains, including `yoursite[.]com` and `your-domain[.]com`, serving selectively targeted macOS scareware and investment-fraud pages.
Sep 25, 2026
Security researchers have uncovered that the majority of parked domains—websites that are expired, dormant, or typographical variants of popular sites—are now being weaponized to serve malicious content. Instead of merely displaying harmless search advertisements, these domains frequently redirect users to scams, malware, and other deceptive content, especially when accessed directly by users rather than automated scanners or VPNs. The threat is exacerbated by the use of lookalike domains, which can easily trick users into visiting malicious sites, as demonstrated by a case where a user attempting to reach the FBI’s Internet Crime Complaint Center was redirected to a scam page after mistyping the domain. The research, led by Infoblox and reported by multiple sources, found that over 90% of visits to parked domains now result in exposure to illegal content, scareware, or malware. The complex ecosystem of domain parking and advertising makes it easy for threat actors to hide their activities and difficult for defenders to attribute attacks. Automated security tools often fail to detect these threats because parked domains can serve benign content to scanners while delivering malicious payloads to real users. This shift marks a significant escalation in the risk associated with direct navigation to parked or typo-squatted domains.
Jun 29, 2026
Security agencies and researchers warned that **ClickFix** social-engineering attacks are spreading through fake verification and brand-impersonation pages that mimic services such as **Google reCAPTCHA** and **Cloudflare**, then trick users into opening `Win+R` or Terminal and pasting clipboard-loaded commands. Recent campaigns have used poisoned websites, fake search results, and spoofed update pages to push victims into launching malicious PowerShell, `mshta`, WebDAV, or shell-based payloads, turning trusted brands and verification flows into an initial access vector without directly compromising the impersonated organizations. The activity has delivered a wide range of malware, including **ACR Stealer**, **HijackLoader**, **StealC**, **Remus**, **Amatera Stealer**, **CastleLoader**, **NetSupport**, Rust-based stealers, and a DPRK-linked macOS backdoor tied to **Contagious Interview**. Microsoft said ACR Stealer campaigns targeting enterprise users stole browser credentials, cookies, tokens, and business files, used scheduled tasks and process injection for persistence and evasion, and in some cases relied on **EtherHiding** to resolve command-and-control infrastructure from Ethereum smart contracts; the macOS campaign similarly used clipboard-driven execution, LaunchAgent persistence, and follow-on payloads that targeted browser data, developer and cloud keys, and cryptocurrency wallets. Defenders were urged to block command execution from untrusted prompts, hunt for published indicators of compromise, and educate users that legitimate verification pages do **not** require running commands locally.
Jul 31, 2026