third-party[.]comDomain
Reported by 3 independent sources · first reported by The Hacker News · last reported
Last reported 26 days ago
What the reports say
4 reports, newest first · the exact sentence from each-
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats“Placeholder Domain Found References in ~1.7K Repos — The "third-party[.]com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users.”
-
Criminals turn placeholder domain into ClickFix trap“Another, third-party[.]com, has often been used in documentation to represent an external website, API, or service.”
-
Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol“Placeholder third-party[.]com domain delivers malware: A threat actor has taken over the third-party.com domain to serve malware via ClickFix attacks.”
-
Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content“Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content”
Indicators reported together
named in the same reports- fbijobs[.]govin 1 report
- mycompany[.]comin 1 report
Copy these 2 indicators · defanged
Also named with it: CVE-2026-87902, CVE-2026-48842, CVE-2026-63077, CVE-2026-28324, CVE-2026-28325, CVE-2026-95281, CVE-2026-95284, CVE-2026-95310, CVE-2026-95313, CVE-2026-95322, CVE-2026-95329, CVE-2026-95339, CVE-2026-95349, CVE-2026-95350, CVE-2026-95356, CVE-2026-95357, CVE-2026-93616, CVE-2026-94127
Thanks — we review every report.