India's STPI portal serves TerminalFix-style malware via fake Cloudflare check
This digest was compiled by AI from multiple sources — links to the originals are below.
A government website linked to India's Software Technology Parks of India is serving a spoofed Cloudflare verification page that copies a malicious command to visitors' clipboards and prompts them to run it in Windows Terminal. Cybersecurity researcher Vibhum Dubey reported the issue to STPI and CERT-In, and the malicious script remained embedded in the site's source after the attack briefly disappeared.
Key Facts
- The malicious activity was observed on the ananta.stpi.in subdomain by cybersecurity researcher Vibhum Dubey.
- The fake Cloudflare page preloads a URL into the clipboard and instructs users to paste it into Windows Terminal.
- The destination URL was flagged as malicious by 17 security engines on VirusTotal at the time of analysis.
- The technique matches Microsoft's TerminalFix pattern, a variant of ClickFix that shifts execution from browser to endpoint.
Attack Mechanism
The page mimics a standard Cloudflare 'Verify you are human' prompt but adds a step instructing users to open Windows Terminal, paste a command, and press Enter. The copied content is a URL that, when pasted into the terminal, initiates a request to attacker-controlled external infrastructure. Dubey did not execute the command, and the destination was flagged by 17 engines on VirusTotal. The method relies on user interaction rather than direct payload delivery, moving the compromise outside traditional web security controls.
TerminalFix Pattern
The technique is consistent with Microsoft's TerminalFix, a variant of ClickFix that uses spoofed verification pages to prompt local command execution. Dubey said the attack follows the same playbook: fake verification page, clipboard injection, and terminal execution instructions. Microsoft has flagged similar patterns in its TerminalFix reporting.
1 source
Time · lag behind first