A website associated with India's Software Technology Parks of India (STPI) was caught hosting a fake Cloudflare verification page designed to compromise user systems. This site was serving a deceptive interface that could copy malicious commands to users' clipboards and instruct them to execute these in Windows Terminal, mirroring patterns seen in emerging cyber attack strategies.
STPI, a government initiative that bolsters India's IT services and startup sector, operates technology platforms for various stakeholders, from tech firms to public sector entities. The troubling activity was discovered on the subdomain ananta.stpi[.]in by cybersecurity researcher and red team expert Vibhum Dubey, who alerted both STPI and CERT-In, India's Computer Emergency Response Team.
Deceptive Verification Steps Lead to Compromise
The malicious page mimicked a legitimate Cloudflare “Verify you are human” check but included an additional step instructing users to open Windows Terminal, paste a predetermined command, and hit Enter. Notably, it preloaded a URL into the clipboard without the user's involvement, allowing for a more seamless transition to potential execution.
If executed, this command would direct the system to interact with external servers controlled by the attackers. Analysis on VirusTotal revealed that multiple security engines flagged the URL as malicious, confirming the setup's intent to exploit unsuspecting users.
Dubey observed that the method redirected the attack's execution from within the browser to the local endpoint, exploiting users' expectations of safety on a trusted government site. “You’d expect STPI services when visiting ananta.stpi[.]in, but instead, you’re faced with a typically reliable verification process,” he remarked. “Most users would unwittingly follow those instructions.”
Resemblance to TerminalFix Attack Techniques
This scenario aligns with a type of attack that Microsoft refers to as TerminalFix, which is part of the broader ClickFix strategy. These attacks utilize spoofed verification pages to prompt users to execute harmful local commands, circumventing standard web security measures.
“This tactic follows a familiar script: a counterfeit verification page, clipboard injection, and terminal execution directives,” Dubey stated. “Microsoft has noted similar behaviors in their TerminalFix analyses.” Despite the lack of direct attribution to a specific campaign, the overlap in techniques—including clipboard manipulation and terminal execution prompts—suggests a connection to previously documented attacks.
Use of Staging for Malicious Commands
Investigating the source code of the affected site revealed a suspicious external script sourced from cdn[.]quickdelivr[.]com, a recently registered domain mimicking the legitimate jsDelivr content delivery network. This domain, registered with an address in Russia, is also linked to three other newly created domains hosted on the same server with ties to Hong Kong.
According to Dubey, the external script is responsible for both the deceptive overlay and the clipboard manipulation, a finding corroborated by CSO. “The attacker seems to be storing critical command-and-control information externally, complicating efforts to shut down the operation,” he noted. The script is heavily obfuscated, complicating analysis and ensuring each visitor is assigned a unique identifier, indicating some level of tracking.
This dynamic script interacts with browser components, allowing for content injection and external communications, raising serious flags about the nature and persistence of the threat.
Ongoing Threats and Vulnerabilities
The fake verification page, which had temporarily vanished, has resurfaced, demonstrating that the vulnerabilities enabling this attack could still be active. Dubey also highlighted potential deficiencies in the site's WordPress configuration, where certain login error messages inadvertently reveal valid administrator usernames.
“The implications of this occurring on a government-linked site are troubling,” he emphasized, noting that the site’s audience includes IT professionals, startups, and government officials. Executing the command could compromise sensitive data or internal systems.
CERT-In acknowledged Dubey’s report and stated it is “actively pursuing appropriate measures with the relevant authorities.” As of the report’s publication, STPI had not responded to inquiries from CSO.
