Executive Summary
Security researchers have identified that the domain third-party[.]com, widely used in developer documentation, AI agent skills, and test suites as a placeholder, has been weaponized to serve ClickFix malware lures. The campaign, which researchers link to the 'TerminalFix' activity, exploits the fact that unlike example.com, third-party[.]com is not a reserved IANA domain. Consequently, any code snippet or documentation hardcoding this domain now serves as a direct pointer to attacker infrastructure.
The attack employs conditional logic to evade detection, serving a benign decoy to macOS and Linux users while presenting Windows visitors with a fake Cloudflare/reCAPTCHA verification page. This lure utilizes clipboard poisoning to stage a malicious PowerShell command, which the user is then socially engineered to execute via the Windows Run dialog (Win+R). This 'fileless' delivery method bypasses traditional antivirus as it relies on signed, native system binaries to establish initial access.
This threat is particularly significant for development teams and organizations utilizing AI coding agents. Automated agents or developers copying documentation examples may inadvertently fetch or execute malicious payloads. The widespread presence of this domain in thousands of public repositories—including those from major software vendors—highlights a critical supply-chain risk where static documentation placeholders are converted into active attack vectors.