Fake AnyDesk Installer Uses Windows Search Redirect to Deliver MetaStealer
Summary
Huntress traced a fake AnyDesk lure through a Cloudflare Turnstile page, Windows File Explorer and an SMB share to an MSI package that collected the victim’s hostname and dropped MetaStealer.
Key points
- The fake installer page used a Cloudflare Turnstile-style verification lure, but redirected victims through Windows’ search-ms protocol rather than a standard ClickFix command-paste flow.
- Windows File Explorer sent victims to an attacker-controlled SMB share, where a shortcut disguised as a PDF launched the next steps.
- The shortcut downloaded a legitimate AnyDesk installer as a decoy and a purported PDF from chat1[.]store; the latter was an MSI package.
- The MSI used the victim’s %COMPUTERNAME% value as a subdomain to collect the computer hostname.
- The MSI’s CAB archive contained a cleanup script and ls26.exe, identified by Huntress as a MetaStealer dropper; observed behavior included crypto-wallet theft.
- Huntress recommends educating users to recognize verification lures that prompt copying commands or redirect to Windows File Explorer; the article also lists associated infrastructure and file hashes.
Article Details
- Attack Vectors
- A fake AnyDesk installer page presented a Cloudflare Turnstile verification lure and redirected users through a Windows search-ms URI to an attacker-controlled SMB share.
- The share contained an LNK shortcut disguised as a PDF. Opening it used cmd.exe to download a legitimate AnyDesk installer and a second, fake PDF that was actually an MSI package.
- The MSI package contained a DLL, a cleanup script, and ls26.exe, identified as the MetaStealer dropper.
- Defensive Notes
- Educate users to treat CAPTCHA or verification prompts that direct them to Windows File Explorer or ask them to copy and paste commands as suspicious.
- Consider restricting use of the Windows Run dialog where it is not needed, while recognizing that this measure does not prevent variants that use other Windows features.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | chat1[.]store | Host from which the fake PDF, actually an MSI package, was downloaded. |
| DOMAIN | cmqsqomiwwksmcsw[.]xyz | Listed in the article's IOC table alongside the MetaStealer C2 indicators. |
| DOMAIN | macawiwmaacckuow[.]xyz | MetaStealer C2 domain, as identified in the article's IOC table. |
| DOMAIN | yeosyyyaewokgioa[.]xyz | Listed in the article's IOC table alongside the MetaStealer C2 indicators. |
| IPV4 | 38[.]134[.]148[.]74 | MetaStealer C2 IP address, as identified in the article's IOC table. |
| SHA256 | 0fc76b7f06aa80a43abafc1e9b88348734e327feb306d700c877c6a210fbd5e7 | SHA-256 hash of ls26.exe, identified as the MetaStealer dropper. |
| SHA256 | 513992d7076984d5c5a42affc12b6a00eef820f3254af75c9958ef3310190317 | SHA-256 hash of Binary.bz.WrappedSetupProgram, a CAB archive containing malicious components. |
| SHA256 | fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1 | SHA-256 hash of CustomActionDLL, a file found in the malicious MSI package. |
| URL | hxxps[:]//anydeesk[.]ink/download/anydesk[.]html | Fake AnyDesk installer page used to present the Cloudflare Turnstile lure. |
| URL | hxxps[:]//verification[.]anydeesk[.]ink/reCAPTCHA-v2[.]php | Redirect destination in the fake AnyDesk lure, leading into the malicious search-ms flow. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe fake installer webpage used obfuscated JavaScript, which the article says was deobfuscated to reveal its redirect.T1036 · MasqueradingThe LNK shortcut and MSI package were presented as PDF files to disguise their nature.T1059.003 · Windows Command ShellThe LNK payload launched cmd.exe to download files and later terminate the cmd.exe process.T1105 · Ingress Tool TransferThe attack downloaded an AnyDesk installer and a fake PDF/MSI package from remote infrastructure.T1204.002 · Malicious FileThe victim was prompted to click an LNK shortcut disguised as a PDF, initiating the infection chain.T1218.007 · MsiexecThe fake PDF was actually an MSI package installed by msiexec.
People
Malware
Products
AnyDeskHomeBlogThe ClickFix Attack That Wasn’t: From a Fake AnyDesk Installer to MetaStealerCloudflare Turnstileanother ClickFix scam, a little bit of digging shows a unique infection chain that involves a fake Cloudflare Turnstile lure, the Windows search protocol, and an MSI package disguised as a PDF that cleverly grabs theMicrosoft Windowslittle bit of digging shows a unique infection chain that involves a fake Cloudflare Turnstile lure, the Windows search protocol, and an MSI package disguised as a PDF that cleverly grabs the victim’s hostname.