New ClickFix Attack Mimic as AnyDesk Leverages Windows Search to Drop MetaStealer
A new variant of the ClickFix attack has been identified, posing as a legitimate AnyDesk installer to distribute the MetaStealer infostealer. This method exploits a deceptive Cloudflare Turnstile verification page to entice users into executing a crafted…
A new variant of the ClickFix attack has been identified, posing as a legitimate AnyDesk installer to distribute the MetaStealer infostealer. This method exploits a deceptive Cloudflare Turnstile verification page to entice users into executing a crafted Windows protocol handler, ultimately delivering a malicious MSI package disguised as a PDF.
This campaign leverages a fake Cloudflare Turnstile verification page to trick victims, using a Windows protocol handler to deliver the malicious payload. The attack uses a crafted MSI package disguised as a PDF, which is installed via a Windows shortcut file named “Readme Anydesk.pdf.lnk.” Unlike previous ClickFix attacks, this method utilizes the search-ms URI handler, redirecting users into Windows File Explorer.
The infection chain is initiated when the search-ms URI invokes a remote SMB share, downloading the LNK file to the victim’s system. This file automatically launches the LNK payload, executing a script to download and install two components: the genuine AnyDesk installer and a decoy PDF from chat1[.]store. The decoy file, in fact, is an MSI package that incorporates the victim’s hostname into its download URL.
The MSI is installed using the following command:
A new variant of the ClickFix attack has been identified, posing as a legitimate AnyDesk installer to distribute the MetaStealer infostealer.
msiexec /i "%TEMP%\%%COMPUTERNAME%%.msi" /quiet
Upon execution, the MSI reveals two primary artifacts: a CustomActionDLL responsible for setup orchestration and a CAB archive containing ls26.exe, the MetaStealer dropper, and cleanup scripts.
The ls26.exe file, protected with Private EXE Protector, exhibits behaviors characteristic of MetaStealer, including credential harvesting from browsers and crypto-wallet theft. The campaign's core tactic is the use of Windows Search, bypassing traditional Run dialog restrictions and introducing payloads directly through File Explorer.
Defenders should monitor unconventional extensions of trusted system features and implement strict protocol handler policies, SMB auditing, and contextual analysis of MSI installations to detect and prevent these sophisticated social-engineering campaigns.
Based on reporting by Cyber Security News.