Listen to the episode
TLDR
The domain third party.com, long used as a placeholder in developer documentation, now hosts a ClickFix attack that impersonates a Cloudflare security check to trick Windows users into running malicious PowerShell commands. Visitors see a...
How it works
The domain third party.com, long used as a placeholder in developer documentation, now hosts a ClickFix attack that impersonates a Cloudflare security check to trick Windows users into running malicious PowerShell commands. Visitors see a...
Red flags
- : Fake Cloudflare "Performing security verification" CAPTCHA appearing on a generic placeholder or unknown domain Instructions asking you to press Win+R, paste from the clipboard, and manually execute a command The page only shows the weaponized flow to Windows user agents
- Linux/macOS visitors get an "unsupported OS" error
What to do
- 1: Never paste or execute commands copied from a website into the Windows Run dialog or a terminal Verify that CAPTCHA pages sit on the real domain (cloudflare.com or the site you intended to visit) before interacting If you already ran the command, disconnect from the network, run a full antivirus/EDR scan, and change passwords from a clean device
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/FAQ
Is Placeholder domain third party.com now serves ClickFix attacks targeting Windows users a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
: Fake Cloudflare "Performing security verification" CAPTCHA appearing on a generic placeholder or unknown domain Instructions asking you to press Win+R, paste from the clipboard, and manually execute a command The page only shows the weaponized flow to Windows user agents; Linux/macOS visitors get an "unsupported OS" error
What should I do first?
: Never paste or execute commands copied from a website into the Windows Run dialog or a terminal Verify that CAPTCHA pages sit on the real domain (cloudflare.com or the site you intended to visit) before interacting If you already ran the command, disconnect from the network, run a full antivirus/EDR scan, and change passwords from a clean device
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.