# From a Fake AnyDesk Installer to MetaStealer

Fake AnyDesk site uses a Turnstile lure to redirect victims via the search-ms URI to an SMB share hosting a LNK disguised as a PDF, dropping MetaStealer.

- Payout: Real-world hack
- Severity: high
- Program: AnyDesk
- Credited: Huntress
- Disclosed: 2025-08-29
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/fake-anydesk-clickfix-metastealer-malware
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fake-anydesk-clickfix-metastealer-malware
- Tags: domain:desktop impact:data-leak impact:integrity kind:incident platform:threat-intel sev:high tech:windows technique:js-analysis technique:recon vuln:misconfiguration

**Target:** Windows endpoint via fake AnyDesk download site and search-ms protocol handler
**Root cause:** Attacker-controlled page redirects to the search-ms URI handler, which opens File Explorer to a remote SMB share containing a malicious LNK; the LNK runs cmd.exe to fetch an MSI that installs MetaStealer.
**Steps:**
1. Victim visits `https://anydeesk.ink/download/anydesk.html` showing fake Cloudflare Turnstile
2. Obfuscated JS redirects to `https://verification.anydeesk.ink/reCAPTCHA-v2.php`
3. PHP redirects to `search-ms:` URI with displayname param pointing to attacker SMB share
4. File Explorer opens SMB share showing `Readme Anydesk.pdf` (actually a LNK)
5. LNK payload runs `cmd.exe` to download legit AnyDesk via Edge and fetch fake PDF from `chat1.store` using `%COMPUTERNAME%` as subdomain
6. `msiexec` installs the MSI; CAB drops `1.js` (cleanup) and `ls26.exe` (MetaStealer dropper)
7. MetaStealer executes, harvesting credentials and crypto wallets, beaconing to C2 domains
**How found:** Researcher received a tip about a fake AnyDesk installer; viewed page source, deobfuscated JS to reveal the reCAPTCHA-v2.php redirect, then followed the search-ms chain and pulled the MSI from chat1.store using a curl user agent.
**Exploitation:** Social engineering lure plus search-ms protocol handler abuse to deliver a signed-looking MSI from a remote SMB share; hostname exfiltrated via DNS subdomain; MetaStealer steals credentials/wallets and files.
**Insight:** The search-ms URI handler can be abused to open File Explorer directly to an attacker SMB share, bypassing Run-dialog restrictions; watch for hostname-as-subdomain DNS callbacks as a victim-tracking trick.