Executive Summary

The domain "third-party.com", often used as a placeholder in developer documentation, is now hosting a fake Cloudflare verification page that lures Windows users into running malicious PowerShell commands. The page mimics a legitimate Cloudflare prompt, exploiting users’ trust in common placeholder domains to deliver a ClickFix-based attack. Security researchers warn that the domain’s widespread use in code examples makes it a prime target for such social‑engineering tactics.

---

Intelligence Metadata - Source Publisher: Bleeping Computer - Published Date: 2026-09-23T22:46:01+00:00 - Category: threat-intel

Original Description: The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands. [...]

"He that never changes his opinions, never corrects his mistakes, and will never be wiser on the morrow than he is today."

— Tryon Edwards