MetaStealerMalware
On March 7, 2022, KELA observed a threat actor named _META_ announcing the launch of META – a new information-stealing malware, available for sale for USD125 per month or USD1000 for unlimited use. The actor claimed it has the same functionality, code, and panel as the Redline stealer, but with several improvements.From MISP Galaxy
Last reported 12 months ago, by Huntress2 reports
ATT&CK techniques
1 technique · each with the sentence it comes from- T1684Social Engineering
“Up to this point, this has all the tell-tale signs of a ClickFix campaign: it involves a classic human verification social engineering piece, and sets the end user up to click on a box.”
What the reports say
2 reports, newest first · the exact sentence from each-
Top Cyber Threat Trends of 2025: Deepfakes, ClickFix & More“Cloudflare Turnstile challenges leading to MetaStealer.”
-
From a Fake AnyDesk Installer to MetaStealer“From a Fake AnyDesk Installer to MetaStealer”
Indicators in its reports
named in the reports above- teams-one[.]comin 1 report
- anydeesk[.]inkin 1 report
- verification.anydeesk[.]inkin 1 report
- chat1[.]storein 1 report
- macawiwmaacckuow[.]xyzin 1 report
- yeosyyyaewokgioa[.]xyzin 1 report
- cmqsqomiwwksmcsw[.]xyzin 1 report
- 38.134.148[.]74in 1 report
- 0fc76b7f06aa80a4…c6a210fbd5e7in 1 report
- fd622cf73ea951a6…02b8dde56fe1in 1 report
- 513992d7076984d5…ef3310190317in 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.