.jpg)
if ( !emtpy($headline_subheadline ) ) : ?>
A government organization providing cloud infrastructure to Indian companies is inadvertently distributing malware.
endif; ?>
A website linked to India’s Software Technology Parks of India (STPI) is serving a spoofed Cloudflare verification page that silently copies a malicious string to visitors’ clipboards and prompts them to execute it via Windows Terminal, in a technique consistent with emerging TerminalFix-style attacks.
STPI, a Government of India organization that supports the country’s IT services and startup ecosystem, operates platforms used by technology firms, developers, and public-sector stakeholders.
The activity was observed on the ananta.stpi[.]in subdomain by cybersecurity researcher and red teamer Vibhum Dubey, who reported the issue to STPI and CERT-In, India’s Computer Emergency Response Team.
A suspicious external JavaScript tied to the behavior remained embedded in the site’s source, even after the attack briefly disappeared, a review by CSO confirmed, indicating the issue may not have been fully resolved.
Fake verification flow used to trigger execution
The page mimics a standard Cloudflare “Verify you are human” prompt, but includes an additional step instructing users to open Windows Terminal, paste a command, and press Enter, and preloads a string into the clipboard without explicit user action, Dubey said.
The copied content is a URL which, when pasted into the terminal, would be interpreted by the system shell to initiate a request to external infrastructure controlled by the attacker. Dubey did not execute the command.
The destination associated with the URL has been flagged as malicious by multiple security vendors, with 17 engines detecting it as malicious on VirusTotal at the time of analysis.
The method shifts execution from the browser to the endpoint, relying on user interaction rather than direct payload delivery.
“What stood out was that this wasn’t a shady email or a fake website, it was on a government portal,” Dubey said. “You go to ananta.stpi[.]in expecting to access STPI services, and you see what looks like a normal Cloudflare verification check. Most users would follow the steps without thinking. That’s what makes it effective: You’re not being redirected somewhere suspicious, you’re already on a site you trust.”
Looks like TerminalFix
The technique observed in this case is consistent with an attack pattern Microsoft calls TerminalFix, a variant of ClickFix. These attacks use spoofed verification pages to prompt users to copy and execute commands locally, moving the point of compromise outside traditional web security controls.
“The technique follows the same playbook: fake verification page, clipboard injection, and instructions to execute via the terminal,” Dubey said. “Microsoft has flagged similar patterns in its TerminalFix reporting.”
While no direct attribution to a specific campaign has been established, the overlap in behavior, including clipboard manipulation, terminal-based execution prompts, and staged delivery, matches documented attack workflows, Dubey said.
Staged delivery
Inspection of the site’s source shows an external script loaded from cdn[.]quickdelivr[.]com, a domain less than a week old and vaguely resembling the legitimate jsDelivr content delivery network. The registrant of the domain name provided an address in Russia, as for at least three other recently registered domains hosted on the same server at an IP address located in Hong Kong, according to data provided by domaintools.com.
Dubey attributed both the fake overlay and clipboard manipulation to this script, a finding independently verified by CSO at the time of reporting.
“The attacker appears to be storing command-and-control configuration on external infrastructure in a way that makes takedowns more difficult,” he said. “The script itself is heavily obfuscated and runs through a virtual machine inside the browser, making it hard to analyze. Each visitor is also assigned a unique identifier, suggesting some level of session tracking.”
The script interacts with browser components including the document object model and network request interfaces, enabling dynamic content injection and communication with external infrastructure, he added.
External configuration and persistence concerns
The fake verification page, which had briefly disappeared, has since reappeared, according to the researcher. The continued presence of the external script indicates that the underlying mechanism enabling the behavior may still be active.
Dubey also pointed to a potential weakness in the site’s WordPress configuration, where the login endpoint reveals a valid administrator username through differential error messages. He noted that confirming whether this was used as an entry point would require server-side analysis.
“What’s concerning here is that it’s appearing on a government-linked site,” he said. “The audience includes IT companies, startups, and officials. If a user executes the command on a work system, it could expose credentials or access to internal environments.”
CERT-In acknowledged the report to the researcher and said it is “in process of taking appropriate action with the concerned authority.”
STPI had not responded to CSO’s queries at the time of publication.
Gyana Swain is a seasoned technology journalist with over 20 years' experience covering the telecom and IT space. He is a consulting editor with VARINDIA and earlier in his career, he held editorial positions at CyberMedia, PTI, 9dot9 Media, and Dennis Publishing. A published author of two books, he combines industry insight with narrative depth. Outside of work, he’s a keen traveler and cricket enthusiast. He earned a B.S. degree from Utkal University.
.jpeg)
