Threat Actors Exploit Windows Search in AnyDesk ClickFix Attack to Spread MetaStealer
MetaStealer, a known commodity infostealer, is being delivered through a new method that combines human-verification social engineering with the Windows search protocol. This technique is part of the ongoing trend of ClickFix scams aimed at harvesting…
MetaStealer, a known commodity infostealer, is being delivered through a new method that combines human-verification social engineering with the Windows search protocol. This technique is part of the ongoing trend of ClickFix scams aimed at harvesting credentials and exfiltrating sensitive files.
The attack begins when users search for the AnyDesk remote-access tool and are redirected to a phishing page, anydeesk[.]ink/download/anydesk.html. This page uses a fake Cloudflare Turnstile verification to trick users. Upon interaction, it redirects to verification.anydeesk[.]ink/reCAPTCHA-v2.php, where a click on the verification box triggers a Windows File Explorer hack.
Unlike traditional ClickFix and FileFix techniques, this attack uses the search-ms URI scheme, which facilitates a custom search query through the Windows File Explorer. This is a departure from previous methods that required users to copy and paste code into the Run dialog or File Explorer address bar.
Disguised LNK Shortcut Snags Hostnames
The phishing page ultimately delivers a malicious Windows shortcut (LNK) file disguised as a PDF. When executed, it downloads the legitimate AnyDesk installer and a malicious "PDF" from chat1[.]store. The PDF uses the victim's %COMPUTERNAME% environment variable to craft its download URL, extracting the hostname automatically.
Further analysis revealed that the chat1[.]store server hosts an MSI package containing a CustomActionDLL and a compressed CAB archive. These unpack a cleanup JavaScript (1.js) and ls26.exe, the MetaStealer dropper. The dropper scans for browser credentials, crypto-wallet files, and documents before exfiltration.
Organizations should consider the following measures to protect against search-ms-based phishing attacks:
Implement strict application whitelisting to prevent unauthorized script execution and MSI installations. Monitor and restrict Windows protocol handlers, such as search-ms, from accessing untrusted SMB shares. Educate users about unsolicited CAPTCHAs or verification prompts that request command execution or file opening. Deploy endpoint detection rules to flag unexpected launches of msiexec.exe, cmd.exe downloads, and SMB share connections.
As these "fix"-style attacks evolve, blending legitimate features with social engineering remains a potent evasion tactic. Continuous user training and layered technical controls are essential to detect and disrupt these infection chains.
This technique is part of the ongoing trend of ClickFix scams aimed at harvesting credentials and exfiltrating sensitive files.
Indicator Description
https[://]anydeesk[.]ink/download/anydesk[.]html Domain with fake Cloudflare Turnstile
macawiwmaacckuow[.]xyz MetaStealer C2 Domain
yeosyyyaewokgioa[.]xyz MetaStealer C2 Domain
cmqsqomiwwksmcsw[.]xyz MetaStealer C2 Domain
38[.]134[.]148[.]74 MetaStealer C2 IP Address
ls26.exe
0fc76b7f06aa80a43abafc1e9b88348734e327feb306d700c877c6a210fbd5e7 MetaStealer dropper PE
CustomActionDLL
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1 File found in MSI package
Binary.bz.WrappedSetupProgram
513992d7076984d5c5a42affc12b6a00eef820f3254af75c9958ef3310190317 CAB file containing malicious components
Based on reporting by GBHackers.