Beyond ClickFix: A New Attack Abuses Windows Search to Deliver MetaStealer

According to Huntress, researchers have observed a widening of ClickFix attacks, with adversaries now abusing the Windows search protocol to deliver MetaStealer alongside disguised lures. The campaign begins with a fake AnyDesk installer hosted at anydeesk[.]ink, prompting victims to complete a Cloudflare Turnstile verification before redirecting them into File Explorer via a search-ms URI.

A shortcut LNK file masquerades as Readme Anydesk.pdf, and clicking it drops both a legitimate AnyDesk installer and a counterfeit PDF that is in fact an MSI package. The fake PDF is cleverly configured to capture the %COMPUTERNAME% environment variable as a subdomain, enabling the attacker to harvest that detail from the victim. Inside the MSI, analysts found a DLL (CustomActionDLL) and a CAB archive containing 1.js (cleanup script) and ls26.exe (the MetaStealer dropper).

MetaStealer’s activities include stealing from crypto wallets, harvesting credentials, and exfiltrating files, with the technique framed as a hybrid of social engineering and semi-legitimate workflows. The report was published on 2 September 2025.