A website operated by India's Software Technology Parks of India is unknowingly delivering malware through a counterfeit Cloudflare security check that secretly loads malicious code onto visitors' clipboards and instructs them to run it through Windows Terminal, according to a report published by CSO Online. The attack was discovered on the ananta.stpi[.]in subdomain by cybersecurity researcher Vibhum Dubey, who notified both STPI and CERT-In, India's Computer Emergency Response Team. STPI is a government body that backs India's IT services sector and startup community, running platforms used by tech companies, developers, and public officials.
The fraudulent page replicates a typical Cloudflare "Verify you are human" screen but adds an extra instruction telling users to launch Windows Terminal, paste a command, and hit Enter, the report states. The system automatically places a URL into the clipboard without any explicit action from the user, and when pasted into the terminal, that URL would trigger the system shell to contact external infrastructure under attacker control. At the time of analysis, 17 security engines on VirusTotal had marked the destination URL as malicious. The technique relies on shifting execution from the web browser to the user's computer, depending on user interaction instead of direct payload transmission. Analysis of the site's code revealed an external script loaded from cdn[.]quickdelivr[.]com, a domain registered less than a week earlier and designed to resemble the legitimate jsDelivr content delivery network, with the domain registrant listing a Russian address.
"What stood out was that this wasn't a shady email or a fake website, it was on a government portal," Dubey said in the report. "You go to ananta.stpi[.]in expecting to access STPI services, and you see what looks like a normal Cloudflare verification check. Most users would follow the steps without thinking." The researcher attributed both the fake overlay and clipboard manipulation to the external script, noting that the attacker appears to store command-and-control setup on external infrastructure in a manner that complicates takedown efforts. The script itself is heavily obfuscated and operates through a virtual machine inside the browser, making analysis difficult, while each visitor receives a unique identifier that suggests some form of session tracking.
The attack method matches a pattern Microsoft calls TerminalFix, a variation of ClickFix that uses spoofed verification screens to push users into copying and executing commands on their own machines, moving the compromise point beyond conventional web security measures. The overlap in behavior—including clipboard manipulation, terminal-based execution prompts, and staged delivery—aligns with documented attack workflows, though no direct attribution to a specific campaign has been confirmed. The fake verification page briefly vanished but has since returned, and a suspicious external JavaScript tied to the behavior remained embedded in the site's source code even after the attack temporarily disappeared, suggesting the underlying issue may not be fully resolved. Dubey also identified a potential vulnerability in the site's WordPress setup, where the login page reveals a valid administrator username through different error messages, though confirming whether this served as an entry point would require server-side investigation.
CERT-In acknowledged receipt of the researcher's report and indicated it is "in process of taking appropriate action with the concerned authority," while STPI had not responded to inquiries at the time of publication. The concern centers on the site's audience, which includes IT firms, startups, and government officials—if a user executes the command on a work system, it could expose credentials or provide access to internal networks. Government infrastructure leveraged for malware distribution represents a severe erosion of institutional trust that adversaries will continue to exploit. The incident highlights how social engineering increasingly bypasses technical defenses by weaponizing the credibility of official platforms themselves.