> TritonInfoSec News
Home / Sep 25, 2026 / Story
0
#6 The Hacker News general September 24, 2026 at 15:27 UTC

Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content

By [email protected] (The Hacker News)

AI Summary

The domain third-party[.]com, historically used as a generic documentation placeholder across 1,700+ repositories, is now actively serving a ClickFix lure that delivers malicious PowerShell commands to Windows users while showing harmless content to other visitors. Manifold Security researcher Ax Sharma confirmed the domain had functioned like example.com for years before being weaponized. Developers who have embedded this domain in documentation, READMEs, or code examples may be unwittingly exposing users to malware delivery.

Read full article → https://thehackernews.com/2026/09/placeholder-thir…

Relevance score: 82.0/100

# More from September 25

  1. 1
    There's a new way to break RSA that's faster than anything we've seen before Ars Technica Security
  2. 2
    Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure The Hacker News
  3. 3
    OpenAI hacked Australian Medicare govt site, probed data providers BleepingComputer
  4. 4
    CISA: Ransomware gangs now exploiting critical TeamCity flaw BleepingComputer
  5. 5
    Digital forensics firm with US federal contracts covered up ties to Russia, DOJ alleges The Record
  6. 7
    Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry The Hacker News
  7. 8
    A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You The Hacker News
  8. 9
    Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer The Hacker News
  9. 10
    Lawmakers introduce bill for voluntary telecom cyber rules after Salt Typhoon hacks The Record