{"id":9474,"date":"2026-09-11T15:26:58","date_gmt":"2026-09-11T15:26:58","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9474"},"modified":"2026-09-11T15:26:58","modified_gmt":"2026-09-11T15:26:58","slug":"indias-stpi-serves-terminalfix-style-attack-via-fake-cloudflare-check","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9474","title":{"rendered":"India\u2019s STPI serves TerminalFix-style attack via fake Cloudflare check"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A website linked to India\u2019s Software Technology Parks of India (STPI) is serving a spoofed Cloudflare verification page that silently copies a malicious string to visitors\u2019 clipboards and prompts them to execute it via Windows Terminal, in a technique consistent with emerging TerminalFix-style attacks.<\/p>\n

STPI, a Government of India organization that supports the country\u2019s IT services and startup ecosystem, operates platforms used by technology firms, developers, and public-sector stakeholders.<\/p>\n

The activity was observed on the ananta.stpi[.]in subdomain by cybersecurity researcher and red teamer Vibhum Dubey<\/a>, who reported the issue to STPI and CERT-In, India\u2019s Computer Emergency Response Team.<\/p>\n

A suspicious external JavaScript tied to the behavior remained embedded in the site\u2019s source, even after the attack briefly disappeared, a review by CSO<\/em> confirmed, indicating the issue may not have been fully resolved.<\/p>\n

Fake verification flow used to trigger execution<\/h2>\n

The page mimics a standard Cloudflare \u201cVerify you are human\u201d prompt, but includes an additional step instructing users to open Windows Terminal, paste a command, and press Enter, and preloads a string into the clipboard without explicit user action, Dubey said.<\/p>\n

The copied content is a URL which, when pasted into the terminal, would be interpreted by the system shell to initiate a request to external infrastructure controlled by the attacker. Dubey did not execute the command.<\/p>\n

The destination associated with the URL has been flagged as malicious by multiple security vendors, with 17 engines detecting it as malicious on VirusTotal at the time of analysis.<\/p>\n

The method shifts execution from the browser to the endpoint, relying on user interaction rather than direct payload delivery.<\/p>\n

\u201cWhat stood out was that this wasn\u2019t a shady email or a fake website, it was on a government portal,\u201d Dubey said. \u201cYou go to ananta.stpi[.]in expecting to access STPI services, and you see what looks like a normal Cloudflare verification check. Most users would follow the steps without thinking. That\u2019s what makes it effective: You\u2019re not being redirected somewhere suspicious, you\u2019re already on a site you trust.\u201d<\/p>\n

Looks like TerminalFix<\/h2>\n

The technique observed in this case is consistent with an attack pattern Microsoft calls TerminalFix<\/a>, a variant of ClickFix. These attacks use spoofed verification pages to prompt users to copy and execute commands locally, moving the point of compromise outside traditional web security controls.<\/p>\n

\u201cThe technique follows the same playbook: fake verification page, clipboard injection, and instructions to execute via the terminal,\u201d Dubey said. \u201cMicrosoft has flagged similar patterns in its TerminalFix reporting.\u201d<\/p>\n

While no direct attribution to a specific campaign has been established, the overlap in behavior, including clipboard manipulation, terminal-based execution prompts, and staged delivery, matches documented attack workflows, Dubey said.<\/p>\n

Staged delivery<\/h2>\n

Inspection of the site\u2019s source shows an external script loaded from cdn[.]quickdelivr[.]com, a domain less than a week old and vaguely resembling the legitimate jsDelivr content delivery network. The registrant of the domain name provided an address in Russia, as for at least three other recently registered domains hosted on the same server at an IP address located in Hong Kong, according to data provided by domaintools.com.<\/p>\n

Dubey attributed both the fake overlay and clipboard manipulation to this script, a finding independently verified by CSO<\/em> at the time of reporting.<\/p>\n

\u201cThe attacker appears to be storing command-and-control configuration on external infrastructure in a way that makes takedowns more difficult,\u201d he said. \u201cThe script itself is heavily obfuscated and runs through a virtual machine inside the browser, making it hard to analyze. Each visitor is also assigned a unique identifier, suggesting some level of session tracking.\u201d<\/p>\n

The script interacts with browser components including the document object model and network request interfaces, enabling dynamic content injection and communication with external infrastructure, he added.<\/p>\n

External configuration and persistence concerns<\/h2>\n

The fake verification page, which had briefly disappeared, has since reappeared, according to the researcher. The continued presence of the external script indicates that the underlying mechanism enabling the behavior may still be active.<\/p>\n

Dubey also pointed to a potential weakness in the site\u2019s WordPress configuration, where the login endpoint reveals a valid administrator username through differential error messages. He noted that confirming whether this was used as an entry point would require server-side analysis.<\/p>\n

\u201cWhat\u2019s concerning here is that it\u2019s appearing on a government-linked site,\u201d he said. \u201cThe audience includes IT companies, startups, and officials. If a user executes the command on a work system, it could expose credentials or access to internal environments.\u201d<\/p>\n

CERT-In acknowledged the report to the researcher and said it is \u201cin process of taking appropriate action with the concerned authority.\u201d<\/p>\n

STPI had not responded to CSO<\/em>\u2019s queries at the time of publication.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A website linked to India\u2019s Software Technology Parks of India (STPI) is serving a spoofed Cloudflare verification page that silently copies a malicious string to visitors\u2019 clipboards and prompts them to execute it via Windows Terminal, in a technique consistent with emerging TerminalFix-style attacks. STPI, a Government of India organization that supports the country\u2019s IT […]<\/p>\n","protected":false},"author":0,"featured_media":9470,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9474","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9474"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9474"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9474\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9470"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9474"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9474"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9474"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}