Threats Tagged 'scareware'

An investigation reveals that placeholder domains commonly used in documentation are serving malicious content through advertising chains. Two domains, yoursite[.]com and your-domain[.]com, present in hundreds of thousands of GitHub files and agent skills, use cloaking techniques to display scams specifically to macOS visitors while showing legitimate parking pages to others. The scams include fake MacOS Security Center warnings and counterfeit news articles promoting investment schemes. These attacks leverage affiliate fraud models, funneling victims through multiple redirectors to genuine services like McAfee subscriptions to earn commissions. Static security checks fail to detect these threats because malicious redirects occur after JavaScript execution. This follows an earlier disclosure about third-party[.]com serving ClickFix lures. The widespread citation of unregistered placeholder domains in documentation creates significant exposure, particularly for AI agents that fetch and act on this content.