India’s STPI serves TerminalFix-style attack via fake Cloudflare check
India's STPI government website serves a spoofed Cloudflare verification page that preloads malicious commands into visitors' clipboards for execution in Windows Terminal, matching TerminalFix-style attacks.
A malicious external JavaScript on the ananta.stpi[.]in subdomain of India's Software Technology Parks of India displays a fake Cloudflare 'Verify you are human' prompt and silently writes a URL into the visitor's clipboard, instructing the user to paste and execute it in Windows Terminal. Researcher Vibhum Dubey reported the behavior to STPI and CERT-In; the script loads from the recently registered cdn[.]quickdelivr[.]com and assigns each visitor a unique session identifier. The malicious script remained embedded after the overlay briefly disappeared, and the destination URL was flagged as malicious by 17 VirusTotal engines. No attribution has been established, though the pattern matches Microsoft's TerminalFix, a variant of ClickFix.
- Fake Cloudflare check on a Government of India portal shifts execution from browser to endpoint
- Clipboard is preloaded without user action; pasted URL triggers a shell request to attacker infrastructure
- Obfuscated script runs in-browser via a virtual machine and fetches external C2 configuration
- Potential WordPress misconfiguration on STPI could reveal an admin username; server-side analysis pending
- CERT-In acknowledged the report and is taking action with the concerned authority
- Vendors
- CloudflareMicrosoft
- Products
- Windows Terminal
- Organizations
- Software Technology Parks of India (STPI)CERT-In
- Countries
- India
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn.quickdelivr.com | n of the site’s source shows an external script loaded from cdn[.]quickdelivr[.]com, a domain less than a week old and vaguely resembling t |
| domain | stpi.in | ector stakeholders. The activity was observed on the ananta.stpi[.]in subdomain by cybersecurity researcher and red teamer Vibh |
From the original article
4 min read at csoonline.com
A website linked to India’s Software Technology Parks of India (STPI) is serving a spoofed Cloudflare verification page that silently copies a malicious string to visitors’ clipboards and prompts them to execute it via Windows Terminal, in a technique consistent with emerging TerminalFix-style attacks.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.