third-party[.]com, a widely used documentation placeholder, serves Windows users a ClickFix lure that plants a PowerShell command.

The “third-party[.]com” domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users.

“third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays,” Manifold Security’s Head of Research, Ax Sharma, said. "Unlike ‘example[.]com,’ third-party[.]com