Fake AnyDesk Installer to MetaStealer: search-ms Alternate-ClickFix Attack

What happened

Huntress security researchers, alerted by an individual who emailed John Hammond after encountering a fake AnyDesk installer while searching for the legitimate remote-access software, reverse-engineered a novel ClickFix-adjacent infection chain. The lure at anydeesk[.]ink presented a fake Cloudflare Turnstile "human verification" prompt; instead of the classic ClickFix Run-dialog paste, a click triggered the Windows search-ms URI protocol handler, opening File Explorer against an attacker-controlled SMB share. That share delivered a shortcut (LNK) disguised as "Readme Anydesk.pdf," which launched cmd.exe to simultaneously download a real AnyDesk installer (as cover) and a second file from chat1[.]store that embedded the victim's %COMPUTERNAME% into its download subdomain and turned out to be an MSI package. The MSI's CustomActionDLL and bundled CAB archive unpacked a cleanup script (1.js) and the MetaStealer dropper (ls26.exe, protected with Private EXE Protector), which exhibited known MetaStealer credential-, file-, and crypto-wallet-stealing behavior. Huntress published full technical details, screenshots, an IOC table, and SHA256 hashes on 2025-08-29.

How it worked

The victim searched online for the legitimate AnyDesk remote-access tool and landed on a lookalike-domain page, anydeesk[.]ink/download/anydesk.html (note the typosquat: "anydeesk" vs "anydesk"). The page displayed a fake Cloudflare Turnstile styled as "Secure Access Verification," prompting a single click to "verify you are human," the classic ClickFix social-engineering hook. Obfuscated JavaScript on the page set window.location.href to https://verification[.]anydeesk[.]ink/reCAPTCHA-v2.php. Where a typical ClickFix attack would now instruct the victim to paste a command into the Windows Run dialog (or, in FileFix variants, into the File Explorer address bar), this chain instead redirected the victim to a prompt to open Windows File Explorer via the Windows search-ms URI protocol handler, a legitimate feature that lets applications launch a pre-configured search in File Explorer. The search-ms call pointed File Explorer at an attacker-controlled SMB share, which displayed a Windows shortcut (LNK) file disguised as a PDF named 'Readme Anydesk.pdf.' Opening it ran cmd.exe, which simultaneously downloaded a genuine AnyDesk installer (to keep the victim from getting suspicious) and a second file from chat1[.]store presented as a PDF. That second file was actually an MSI installer, and its download URL was crafted to embed the victim's own %COMPUTERNAME% environment variable as a subdomain, letting the attacker fingerprint/track the specific host without prior knowledge of it. msiexec then installed the MSI, which contained a CustomActionDLL and a CAB archive (Binary.bz.WrappedSetupProgram) unpacking to 1.js (a cleanup script that removed traces of the infection chain) and ls26.exe, the MetaStealer dropper, packed with Private EXE Protector. Analysis of the final payload matched known MetaStealer behavior, including harvesting browser-stored credentials, files, and cryptocurrency wallet data.

The lure and the tell

The lure was a typosquatted download page (anydeesk[.]ink, missing/altered letters vs. the real anydesk.com) surfaced to someone actively searching for the legitimate AnyDesk software, paired with a fake Cloudflare Turnstile "Secure Access Verification" prompt mimicking a routine bot-check. The tell-tale signs, visible in hindsight: the domain typo itself, an unusual verification page for what should be a direct software download, and a "verify you're human" click that led not to the file downloading but to a Windows File Explorer/search prompt and then an SMB network share, none of which are normal parts of installing desktop software. The final dropped file was named "Readme Anydesk.pdf" but was actually an LNK shortcut, and the subsequent "PDF" from chat1[.]store was in fact an MSI installer, both classic file-type disguises that a careful user could catch by checking real file extensions/properties.

Outcome

Huntress's John Hammond was alerted to the fake installer by an unnamed individual who encountered it, and Huntress's research team reverse-engineered the full infection chain, publishing detailed technical analysis, IOCs, and file hashes on 2025-08-29 ("The ClickFix Attack That Wasn't: From a Fake AnyDesk Installer to MetaStealer"). The write-up does not state whether the reporting victim's system was actually compromised by MetaStealer or whether they stopped short of full infection; the emphasis of the source is on the attack chain's mechanics rather than confirmed post-compromise impact. The research was later syndicated via Huntress's own follow-up digest (republished on BleepingComputer, 2025-09-17) and covered by multiple secondary outlets (Cybernoz, HackRead, Daily CyberSecurity) in early September 2025.

Why it matters

This case shows ClickFix-style social engineering actively mutating past the mitigations organizations have put in place. Where security guidance has focused on restricting the Windows Run dialog to blunt classic ClickFix and PowerShell-paste FileFix variants, this campaign routes around that control entirely by abusing the legitimate, lesser-monitored search-ms URI protocol handler to pull payloads via SMB, then hides the actual payload type twice over (LNK-as-PDF, then MSI-as-PDF). It also demonstrates a subtle new fingerprinting trick, encoding the victim's own hostname into a download subdomain, that lets attackers track individual targets without needing to have gathered that information beforehand. For defenders and end users alike, it underscores that "verify you're human" prompts and single-click "fixes" remain a potent lure even as the underlying technical mechanism keeps changing, and that file-type disguises (LNK/MSI presented as PDF) require verification beyond the displayed filename.

Defenses

Huntress notes that Run-dialog restrictions aimed at traditional ClickFix do not address variants that redirect to Windows File Explorer, and recommends educating users about such lures. Potential additional measures include: restrict or monitor use of the search-ms protocol handler (e.g., via registry/GPO removal of the search-ms/search: URI scheme where not needed), block or tightly control outbound SMB to external/untrusted hosts, treat unsolicited "installer" downloads for remote-access tools (AnyDesk, etc.) found via search results as high-risk, inspect file extensions/true file type before opening (LNK/MSI disguised as PDF), and maintain user education that "verification" prompts asking you to take manual action to fix an alleged problem are a red flag regardless of which Windows mechanism they invoke. Endpoint detection should flag msiexec installing packages fetched from just-downloaded temp-directory files, and unusual child processes of cmd.exe following LNK execution.