Full Report
Learn how a fake AnyDesk installer led to a unique MetaStealer attack, highlighting how threat actors evolve ClickFix techniques beyond the classic playbook to steal credentials and files.
Analysis Summary
# Tool/Technique: MetaStealer via Fake AnyDesk Installer (ClickFix Evolution)
## Overview
This attack involves a sophisticated social engineering campaign that evolves the "ClickFix" technique. Instead of the traditional method of tricking users into pasting PowerShell commands, this variant uses a fake Cloudflare Turnstile lure to trigger the Windows search protocol, ultimately delivering MetaStealer. The goal is to harvest credentials, browser data, and sensitive files from infected Windows systems.
## Technical Details
- **Type:** Malware Family (Infostealer) and Delivery Technique
- **Platform:** Windows
- **Capabilities:** Credential harvesting, file exfiltration, host information gathering, browser data theft.
- **First Seen:** MetaStealer has been active since 2022; this specific ClickFix-variant delivery method was reported in late August 2024.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1204.001 - User Execution: Malicious Link]
- [T1204.002 - User Execution: Malicious File]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1218.007 - System Binary Proxy Execution: Msiexec]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **Browser Data Theft:** Steals saved passwords, cookies, and autofill data from popular web browsers.
- **Credential Harvesting:** Targets crypto wallets, FTP clients, and email credentials.
- **Information Gathering:** Collects system metadata including hostname, OS version, and hardware specs.
### Advanced Features
- **Search Protocol Abuse:** Uses the `search-ms` URI protocol to open Windows File Explorer and point users toward a remote malicious file.
- **MSI Masquerading:** The payload is delivered as an `.msi` package but is frequently disguised with PDF icons or names to lower user suspicion.
- **Dynamic Hostname Integration:** The attack chain involves a clever mechanism to grab the victim’s hostname during the initial stages to customize the delivery.
## Indicators of Compromise
*Note: Indicators are based on the specific incident described in the article.*
- **File Names:**
- `anydesk.msi`
- `AnyDesk_Installer.msi`
- **Network Indicators:**
- `anydeesk[.]ink` (Phishing domain)
- `verification[.]anydeesk[.]ink` (Redirect/Lure)
- `teams-one[.]com` (Related ClickFix infrastructure)
- **Behavioral Indicators:**
- Unexpected browser calls to `search-ms:` or `window.location.href` involving external IPs or suspicious domains.
- Execution of `msiexec.exe` calling out to remote `.msi` files hosted on non-standard domains.
## Associated Threat Actors
- While MetaStealer is a commodity infostealer sold on underground forums, this specific evolved ClickFix campaign is attributed to unidentified financially motivated actors leveraging **ClickFix/FileFix** templates.
## Detection Methods
- **Signature-based detection:** Modern EDR and AV solutions maintain signatures for MetaStealer binaries and MSI-based droppers.
- **Behavioral detection:**
- Monitor for browser processes (Chrome, Edge) spawning the Windows Search protocol (`search-ms`).
- Alert on `msiexec.exe` connecting to the internet to download and install packages from untrusted external domains.
- **YARA Rules:** Security teams should look for rules targeting MetaStealer's unique string encryption and C2 communication patterns.
## Mitigation Strategies
- **User Training:** Educate employees on the "ClickFix" tactic—specifically, that no legitimate human verification (like Cloudflare or CAPTCHA) will ever require them to paste commands or open Windows Search.
- **URL Filtering:** Block access to newly registered domains (NRDs) and domains masquerading as AnyDesk or IT tools.
- **Protocol Handling:** Consider disabling or restricting URI schemes like `search-ms` via Group Policy if not required for business operations.
- **AppLocker/Windows Defender Application Control (WDAC):** Prevent the execution of unsigned or untrusted MSI packages.
## Related Tools/Techniques
- **ClickFix:** The parent technique involving fake error prompts.
- **FileFix:** A variant focusing on File Explorer lures.
- **LummaC2 / Rhadamanthys:** Other infostealers frequently distributed via similar CAPTCHA-based lures.