Full Report
The "third-party[.]com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. "third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays," Manifold Security's Head of Research, Ax Sharma, said. "Unlike 'example[.]com,' third-party[.]com
Analysis Summary
# Incident Report: Hijack of "third-party[.]com" Documentation Placeholder
## Executive Summary
The domain `third-party[.]com`, long utilized by developers as a generic documentation placeholder, was identified serving malicious "ClickFix" lures to Windows-based web browsers. The attack employed browser-side fingerprinting to deliver malware to targeted users while displaying a benign decoy site to non-Windows users or security scanners. This incident highlights the risk of using non-reserved, privately owned domains as placeholders in technical documentation.
## Incident Details
- **Discovery Date:** October 2024 (based on Manifold Security report)
- **Incident Date:** Ongoing/Active at time of report
- **Affected Organization:** Global developers and end-users interacting with documentation using this placeholder.
- **Sector:** Information Technology / Software Development
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Circa Q3/Q4 2024
- **Vector:** Domain Hijacking / Malicious Ownership
- **Details:** Attackers gained control of the `third-party[.]com` domain, which has historically been treated by the tech community as a safe, reserved placeholder similar to `example[.]com`.
### Lateral Movement
- **Details:** N/A (The attack focuses on external users visiting the domain via documentation links rather than internal network movement).
### Data Exfiltration/Impact
- **Details:** The primary impact is the attempted delivery of malware via the "ClickFix" technique, which tricks users into executing malicious PowerShell commands or downloading infected installers to compromise their local workstations.
### Detection & Response
- **How it was discovered:** Research by Ax Sharma and the Manifold Security team.
- **Response actions taken:** Public disclosure by security researchers to warn the developer community; recommendation to cease use of the domain in documentation.
## Attack Methodology
- **Initial Access:** User-initiated visit to a compromised legacy documentation domain.
- **Persistence:** Not specified (typical ClickFix leads to Infostealers or RATs).
- **Privilege Escalation:** Exploitation of social engineering to trick users into running high-privileged commands (e.g., PowerShell).
- **Defense Evasion:** Browser-based fingerprinting/filtering; the site displays a "harmless decoy" to non-Windows users and researchers to avoid automated detection.
- **Credential Access:** Likely goal of the ClickFix payload (Infostealers).
- **Discovery:** N/A
- **Lateral Movement:** N/A
- **Collection:** N/A
- **Exfiltration:** N/A
- **Impact:** System compromise via ClickFix (socially engineered execution).
## Impact Assessment
- **Financial:** Potential loss for organizations whose employees' workstations are compromised via Infostealers.
- **Data Breach:** Risk of credential theft (browser-stored passwords, session cookies).
- **Operational:** Disruption to developers needing to update legacy documentation.
- **Reputational:** High risk for developers who inadvertently directed customers to a malicious domain in their manuals/guides.
## Indicators of Compromise
- **Network indicators:**
- `third-party[.]com` (Defanged)
- **Behavioral indicators:**
- Website prompting users to copy/paste code into a terminal to "fix" a browser error (ClickFix pattern).
- Domain displaying different content based on User-Agent strings.
## Response Actions
- **Containment measures:** Block access to `third-party[.]com` at the enterprise DNS/Firewall level.
- **Eradication steps:** Remove all references to `third-party[.]com` from internal and public-facing documentation.
- **Recovery actions:** Audit systems of users who have recently visited the domain.
## Lessons Learned
- **Key takeaways:** Never assume a domain is a "reserved" placeholder unless it is officially designated by IANA (like `example.com`, `.test`, or `.local`).
- **What could have been done better:** Documentation standards should strictly enforce the use of RFC 2606 reserved domains to prevent "placeholder squatting."
## Recommendations
- **Prevention measures:**
- Update all documentation to use `example[.]com`, `example[.]net`, or `example[.]org`.
- Educate staff on the "ClickFix" lure, specifically warning against pasting code into PowerShell/Command Prompt from a browser source.
- Implement web filtering that categorizes and blocks newly suspicious or dynamic documentation placeholders.