Placeholder Domains Whose Ads Serve Scams

An investigation reveals that placeholder domains commonly used in documentation are serving malicious content through advertising chains. Two domains, yoursite[.]com and your-domain[.]com, present in hundreds of thousands of GitHub files and agent skills, use cloaking techniques to display scams specifically to macOS visitors while showing legitimate parking pages to others. The scams include fake MacOS Security Center warnings and counterfeit news articles promoting investment schemes. These attacks leverage affiliate fraud models, funneling victims through multiple redirectors to genuine services like McAfee subscriptions to earn commissions. Static security checks fail to detect these threats because malicious redirects occur after JavaScript execution. This follows an earlier disclosure about third-party[.]com serving ClickFix lures. The widespread citation of unregistered placeholder domains in documentation creates significant exposure, particularly for AI agents that fetch and act on this content.

• Beyond the clipboard: The evolving tradecraft of ClickFixMalware2026-11-10
• 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RATMalware2026-11-13
• Fake Zillow pages use ClickFix NetSupport RAT to target apartment huntersMalware2026-11-13
• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05
• How Attackers Redirect Crypto PaymentsMalware2026-10-29