A Government of India Website Is Tricking Visitors Into Running Malware From Their Own Keyboard
A fake security check on a page linked to India's STPI quietly loads a harmful command onto visitors' clipboards, then asks them to paste and run it themselves.
Key points
- A subdomain of India's Software Technology Parks of India (STPI), a government body that supports the country's tech industry, was found serving a fake security verification page designed to hijack visitors' computers.
- The attack silently copies a malicious command into a visitor's clipboard and instructs them to paste it into Windows Terminal, the command-line tool built into modern Windows computers, and press Enter.
- Cybersecurity researcher Vibhum Dubey discovered the attack, reported it to STPI and CERT-In (India's national computer emergency team), but as of publication the malicious script remained embedded in the site.
- The hostile code was loaded from a domain less than a week old, registered with a Russian address, and hosted on a server in Hong Kong.
- CERT-In acknowledged the report and said it is taking action; STPI had not responded.
When you land on a government website, you expect it to be safe. That assumption is exactly what this attack depends on.
Visitors to ananta.stpi[.]in, a subdomain belonging to Software Technology Parks of India, a government organisation that helps Indian tech companies and startups, were met with what looked like a routine Cloudflare verification prompt. Cloudflare is a widely used internet security company, and its "Verify you are human" checkbox appears on millions of websites every day. Most people click through without a second thought.
This one was fake. And it had an extra step.
How does the attack actually work?
Instead of just asking visitors to tick a box, the page told them to open Windows Terminal, a text-based control panel for Windows computers, paste in a command, and hit Enter. The trick: the site had already quietly copied that command to the visitor's clipboard, the temporary storage your computer uses when you copy and paste text, without any button click or warning.
Pasting and running that command would have sent the visitor's computer to external infrastructure controlled by the attackers. Seventeen separate security scanning tools flagged the destination as malicious on VirusTotal, a service that checks links and files against hundreds of security databases.
Dubey did not run the command himself. Wise move.
"You go to ananta.stpi[.]in expecting to access STPI services, and you see what looks like a normal Cloudflare verification check," Dubey said. "Most users would follow the steps without thinking. That's what makes it effective."
Why is this harder to stop than a normal attack?
Traditional web attacks try to infect you through the browser directly. This one sidesteps that entirely. By tricking the visitor into typing the command themselves, the attack moves outside the reach of most browser security tools. The browser never downloads anything suspicious. You do the work for the attacker.
Microsoft has documented this pattern under the name TerminalFix, a variation of a broader family of scams called ClickFix. The playbook is consistent: fake verification page, silent clipboard injection, and instructions to paste into a terminal.
| Detail | Finding |
|---|---|
| Affected site | ananta.stpi[.]in |
| Malicious script source | cdn[.]quickdelivr[.]com |
| Script domain age at discovery | Less than one week |
| Registrant location | Russia (listed address) |
| Server location | Hong Kong |
| VirusTotal detections on payload URL | 17 of multiple engines |
CSO Online independently confirmed the external script was still embedded in the site's source code even after the fake page briefly disappeared and then reappeared.
The script was heavily disguised to make analysis difficult, assigned each visitor a unique tracking ID, and communicated with remote servers to pull in its instructions, meaning simply taking down one piece would not necessarily stop it.
Should ordinary visitors be worried?
If you visited the site but did not open Windows Terminal and paste anything, you are almost certainly fine. The attack requires you to take that manual step.
If you did run a pasted command from that site, treat it seriously. Change passwords on any accounts you accessed from that computer, alert your IT or security team if it is a work machine, and consider running a full malware scan.
The failure mode here is straightforward: people trust government URLs, so they follow instructions they would reject on an unfamiliar site. Security training that teaches staff to question any instruction to open a terminal and paste something, even on a trusted page, would have stopped this cold.
One operational takeaway: clipboard-hijacking attacks require the victim's own hands to succeed, which means the last line of defence is a person who pauses before pressing Enter.
