Visitors to the domain are served a fake Cloudflare verification page designed to trick Windows users into running malicious PowerShell commands on their own systems. This is the hallmark of the ClickFix technique, where victims are convinced to paste and execute commands under the guise of proving they are human or completing a security check. Because the domain has long been trusted as a neutral example in tutorials and code samples, users may be more likely to let their guard down.

• The attack relies on a fake Cloudflare human-verification prompt.
• It targets Windows users and attempts to get them to execute PowerShell commands.
• The domain involved is third-party.com, a common placeholder in documentation.

If your organization uses placeholder domains in internal documentation or tooling, it may be worth reviewing whether any references point to this domain, and reminding users that legitimate verification pages never require pasting commands into a terminal or Run dialog.

Source: BleepingComputer

Has anyone checked whether third-party.com appears anywhere in their own documentation or codebase?