From a Fake AnyDesk Installer to MetaStealer

This report details a social-engineering campaign that masquerades as a fake AnyDesk installer and Cloudflare Turnstile verification to redirect victims via the search-ms Windows protocol to an attacker-controlled SMB share; a disguised LNK leads to an MSI that installs MetaStealer, a commodity infostealer that harvests credentials and crypto wallet data — the report includes IOCs (domains, IP, and SHA256 hashes) and analysis of the infection chain and payload.