Threat Actors Exploit Windows Search in AnyDesk ClickFix Attack to Spread MetaStealer

In GBHackers on Security, Mayura Kathir reports a novel ClickFix-style campaign that uses the Windows search-ms URI protocol to trigger an infection chain and drop MetaStealer, a credential-harvesting infostealer.

The attack starts after a target searches for AnyDesk and lands on a phishing page that imitates Cloudflare Turnstile human verification; after clicking verify, the browser opens Windows File Explorer to a custom search query, which silently connects to an attacker-controlled SMB share presenting a false Readme AnyDesk.pdf. A disguised LNK shortcut then executes, silently downloading the legitimate AnyDesk installer via Microsoft Edge and retrieving a malicious PDF from chat1[.]store.

The MSI package within the download contains a CustomActionDLL and a Binary.bz[.]WrappedSetupProgram CAB, unpacking 1.js and ls26.exe, the MetaStealer dropper, with ls26.exe protected and capable of harvesting browser credentials and crypto-wallet files before exfiltration. The report notes that this variant bypasses typical Run or File Explorer prompts by leveraging the search-ms flow and SMB shares, marking an evolution in ClickFix and FileFix techniques. September 2, 2025.