Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A recent attack mimicking ClickFix tactics used a fake AnyDesk installer to deploy MetaStealer. The infection chain involved a fake Cloudflare Turnstile lure, Windows search protocol, and an MSI package disguised as a PDF. Unlike traditional ClickFix attacks, this variant redirected users to Windows File Explorer instead of the Run dialog box. The attack cleverly grabbed the victim's hostname and ultimately aimed to drop MetaStealer, a commodity infostealer known for harvesting credentials and stealing files. This incident highlights the evolving nature of social engineering attacks and the need for updated security measures and user education.

This threat involves a sophisticated social engineering malware campaign that leverages a fake AnyDesk installer to deploy MetaStealer, a commodity information stealer malware. The attack chain is notable for mimicking tactics used by the ClickFix malware family but introduces novel techniques to evade detection and increase user deception. The infection begins with a lure that impersonates Cloudflare's Turnstile CAPTCHA service, tricking victims into interacting with a malicious webpage. Instead of the traditional ClickFix method of redirecting users to the Windows Run dialog, this variant redirects victims to Windows File Explorer via the Windows Search Protocol, which is an unusual and stealthy approach to execute the payload. The payload itself is an MSI package disguised as a PDF file, further increasing the likelihood of user execution due to the familiar file extension. Once executed, the malware collects the victim's hostname to tailor its actions and then drops MetaStealer. MetaStealer is known for harvesting sensitive credentials, stealing files, and potentially enabling further compromise through credential reuse or lateral movement. The attack utilizes multiple MITRE ATT&CK techniques such as T1113 (screen capture), T1056.001 (input capture: keylogging), T1074.001 (data staged), T1114.001 (email collection), T1005 (data from local system), T1140 (deobfuscate/decode files or information), T1555 (credentials from password stores), T1036 (masquerading), T1055 (process injection), T1087 (account discovery), T1083 (file and directory discovery), T1102 (web service), T1204 (user execution), T1547.001 (boot or logon autostart execution), T1566 (phishing), T1027 (obfuscated files or information), T1012 (query registry), T1059.003 (command and scripting interpreter: Windows Command Shell), and T1070.004 (indicator removal on host: file deletion). Indicators of compromise include hashes of the malicious MSI files, IP addresses, and domains used for hosting the fake installer and command and control. This attack highlights the evolving sophistication of social engineering campaigns and the importance of updated detection and user awareness strategies.

Detailed information about From a Fake AnyDesk Installer to MetaStealer. Get real-time updates, technical details, and mitigation strategies.

From a Fake AnyDesk Installer to MetaStealer - Live Threat Intelligence - Threat Radar | OffSeq.com

From a Fake AnyDesk Installer to MetaStealer

Threats Tagged 'metastealer'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'metastealer'

Lead Pen Test Professional