Placeholder Domain ‘third‑party.com’ Repurposed for Malicious PowerShell Phishing Campaign

Security researchers have discovered that the domain third‑party.com, long used as a generic placeholder in code samples and developer guides, is now hosting a fraudulent Cloudflare verification page designed to lure Windows users into running malicious PowerShell commands. The discovery was first reported by security outlet BleepingComputer after multiple users reported suspicious prompts.

The domain has historically appeared in documentation as a neutral example address, similar to example.com, allowing authors to illustrate URLs without directing traffic to real sites. Because the name is widely recognized as a dummy address, many developers and automated tools reference it without suspecting abuse. Because the address resolves to a live server, any site that copies the placeholder can inadvertently direct traffic to the malicious host.

In its new role, the site presents a page that mimics the familiar Cloudflare challenge that legitimate sites display when a visitor is flagged for suspicious activity. The page asks visitors to confirm they are not a robot, but instead of a simple checkbox it offers a button that, when clicked, triggers a script that claims to verify the user’s browser. The page also includes branding elements such as the Cloudflare logo and color scheme, making the deception harder to spot for non‑technical users.

The script is crafted to exploit the default behavior of Windows PowerShell, prompting users to copy and paste a one‑line command into a PowerShell window. The command downloads and executes additional payloads from remote servers, giving attackers the ability to install malware, exfiltrate data, or gain persistent access to the compromised machine. The downloaded payload is typically obfuscated, allowing the attacker to bypass basic antivirus scans. Once executed, the code can open a reverse shell or install a cryptocurrency miner, depending on the operator’s objectives.

Cybersecurity firms have warned that the attack vector relies on social engineering rather than a technical vulnerability, counting on users’ familiarity with Cloudflare prompts and their willingness to follow seemingly legitimate instructions. Users are advised to avoid executing code from unverified sources, to verify the authenticity of any Cloudflare challenge by checking the URL, and to keep PowerShell’s execution policy at a restrictive level. Organizations should consider disabling PowerShell remoting for standard users and employing application control solutions that block unsigned scripts.

The repurposing of a placeholder domain underscores a broader trend where threat actors co‑opt innocuous‑looking internet resources to increase the credibility of phishing campaigns. Defenders are urged to monitor traffic to known example domains, update security policies to flag unexpected Cloudflare verification pages, and educate developers about the risks of using real‑world domains in documentation. Researchers expect that similar tactics may appear on other placeholder domains, prompting a reevaluation of how developers reference example URLs in public repositories.