Widely Used 'Example' Domain Now Serving Malware to Windows Users

Security researchers have found that third-party[.]com, a generic placeholder domain commonly used in technical documentation similar to example.com, has been taken over and is now serving malicious content. Unlike example.com, this domain was never officially reserved, meaning anyone could register it, and someone has, since at least June 2026.

Windows users who land on the site through old documentation links are shown a fake Cloudflare security check. This tricks them into copying a malicious command to their clipboard and pasting it into the Windows Run dialog, which then downloads and runs a hidden PowerShell payload. This technique, known as ClickFix or pastejacking, relies on tricking users into running commands themselves rather than exploiting a technical flaw. Mac users visiting the same page are shown a harmless error message instead, likely to avoid drawing attention while the attack focuses on Windows targets.

The domain has already been flagged as malicious by VirusTotal and Google Safe Browsing, but it remains referenced in more than 1,700 public code repositories, including AI agent and developer documentation that used it as a harmless example endpoint. Any business whose staff, developers, or automated tools click through old documentation links containing this domain could be exposed.