How the Scam Works Mechanically

Cybercriminals have weaponized the domain 'third-party.com', a site historically used as a generic placeholder in developer documentation and code examples. This domain, unlike reserved documentation domains like example.com, is a registered domain that can be controlled by its owner. The attackers are presenting a fake Cloudflare security verification page, designed to appear as a legitimate CAPTCHA. When a user interacts with this fake verification, the site copies a malicious PowerShell command into the Windows clipboard. Users are then prompted to manually execute this command by pressing Windows Key + R, pasting the command (Ctrl+V), and pressing Enter. This technique, known as ClickFix, bypasses traditional malware delivery methods by relying on user interaction to execute the malicious payload. The executed PowerShell script then attempts to download and run further malware from a remote server. While the specific payload URL used in the initial discovery was no longer active, historical scans indicate it was configured to download a ZIP archive, the contents of which remain unknown but are presumed to be malicious. Notably, this attack specifically targets Windows users; visitors using macOS or Linux are presented with an error message and do not encounter the malicious payload, making the threat harder to detect for those not using Windows.

Warning Signs & Red Flags

  • A security verification page that appears unexpectedly, especially if you are not actively performing a security check.
  • A prompt instructing you to copy and paste commands into your system's run dialog (Windows Key + R).
  • Websites that claim your operating system is unsupported and only work on Windows, while other operating systems receive an error.
  • Unusual URLs or domains that you don't recognize, even if they seem related to a known service like Cloudflare.
  • Requests to execute unfamiliar commands or scripts on your system.

How to Protect Yourself & Report

To safeguard against this and similar phishing attacks, always exercise extreme caution when encountering unexpected security prompts or requests to execute commands. Never copy and paste commands from websites into your system's command line or run dialog unless you fully understand their function and trust the source implicitly. Developers should be vigilant about the domains used in their documentation and code examples, opting for officially reserved placeholder domains like example.com, example.net, and example.org, rather than commonly used but unregistered domains. If you encounter such a malicious page, do not interact with it. Report the suspicious website to your browser's security features (e.g., Google Safe Browsing, which has already flagged third-party.com) and to cybersecurity organizations. This helps protect others from falling victim to these evolving threats.