MalwarePublished 30 Aug 2025Updated 29 Sep 2025

From a Fake AnyDesk Installer to MetaStealer

Source AlienVault OTX General

Description

A recent attack mimicking ClickFix tactics used a fake AnyDesk installer to deploy MetaStealer. The infection chain involved a fake Cloudflare Turnstile lure, Windows search protocol, and an MSI package disguised as a PDF. Unlike traditional ClickFix attacks, this variant redirected users to Windows File Explorer instead of the Run dialog box. The attack cleverly grabbed the victim's hostname and ultimately aimed to drop MetaStealer, a commodity infostealer known for harvesting credentials and stealing files. This incident highlights the evolving nature of social engineering attacks and the need for updated security measures and user education.

Impact

For European organizations, this threat poses a significant risk to confidentiality and integrity of sensitive data. MetaStealer’s capability to harvest credentials can lead to unauthorized access to corporate networks, email accounts, and cloud services, potentially resulting in data breaches, intellectual property theft, and financial fraud. The use of a fake AnyDesk installer is particularly dangerous as AnyDesk is widely used for remote support and administration, so users may be more inclined to trust and execute the fake installer. The attack’s stealthy execution method via Windows File Explorer and MSI disguised as PDFs increases the likelihood of successful infection. Organizations with remote workforces or those relying heavily on remote desktop tools are especially vulnerable. Additionally, the malware’s ability to collect system information and perform persistence mechanisms can facilitate prolonged undetected access, increasing the risk of lateral movement and further compromise. The medium severity rating reflects the moderate difficulty of exploitation (requiring user interaction) but significant potential damage if successful. The threat also underscores the need for vigilance against phishing and social engineering, which remain primary vectors for initial compromise in Europe’s diverse and highly regulated cybersecurity environment.

Defensive guidance

1. Implement strict email and web filtering to block access to known malicious domains and URLs associated with this campaign (e.g., anydeesk.ink and related domains). 2. Deploy endpoint detection and response (EDR) solutions capable of detecting suspicious MSI execution, masquerading, and process injection behaviors. 3. Enforce application whitelisting policies to prevent execution of unauthorized MSI packages and executables, especially those masquerading as PDFs. 4. Educate users about the risks of downloading and executing software from unofficial sources, emphasizing the dangers of fake remote desktop tools and social engineering lures mimicking legitimate services like Cloudflare Turnstile. 5. Monitor for unusual use of Windows Search Protocol and unexpected redirections to Windows File Explorer, which may indicate exploitation attempts. 6. Regularly audit and restrict the use of administrative privileges and credential storage to limit the impact of credential theft. 7. Use multi-factor authentication (MFA) across all critical systems to mitigate the risk of compromised credentials being abused. 8. Maintain up-to-date threat intelligence feeds and integrate IoCs such as hashes, IPs, and domains into security monitoring tools for early detection. 9. Conduct phishing simulation exercises tailored to the latest social engineering tactics to improve user resilience. 10. Review and harden system configurations to limit MSI package execution and disable unnecessary scripting capabilities where feasible.

Indicators of compromise

Domains 7

anydeesk.ink
chat1.store
cmqsqomiwwksmcsw.xyz
macawiwmaacckuow.xyz
teams-one.com
yeosyyyaewokgioa.xyz
verification.anydeesk.ink

URLs 2

http://anydeesk.ink/download/anydesk.html
http://verification.anydeesk.ink/reCAPTCHA-v2.php

IP addresses 1

38.134.148.74

Hashes 3

0fc76b7f06aa80a43abafc1e9b88348734e327feb306d700c877c6a210fbd5e7
513992d7076984d5c5a42affc12b6a00eef820f3254af75c9958ef3310190317
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Sep 2025, 08:33 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details