A Familiar Name Used as a Dangerous Disguise

A fake CCleaner installer is delivering GhostDesk, a spyware that hijacks Chrome to steal credentials in real-time. It records keystrokes and bypasses traditional endpoint security by operating direct

A convincing fake CCleaner website delivers a multi-stage malware attack that installs a spyware extension inside Chrome.

A convincing fake CCleaner website delivers a multi-stage malware attack that installs a spyware extension inside Chrome.

A convincing fake CCleaner website delivers a multi-stage malware attack that installs a spyware extension inside Chrome.

✓ Domain monitoring software helps expose brand abuse, malicious domains, and browser spyware before they reach customers.

Windows users looking for a familiar cleanup utility are being steered toward a convincing counterfeit download page. The file they receive installs GhostDesk, a malicious Chrome extension built to watch activity inside the browser. The campaign turns a routine software download into a pathway for credential theft, keystroke capture, screenshots, cookie collection, and commands delivered to browser tabs. Its use of a trusted application name shows why a polished page and familiar icon cannot establish that a download is safe. Malwarebytes said in a report shared with Cyber Security News (CSN) that the operation begins with a fake CCleaner site and proceeds through a multi-stage Windows infection. The researchers found the lure at ccleanerwind[.]top, where both displayed download choices served the same harmful executable. The immediate impact is potentially serious for anyone who uses Chrome for email, banking, work portals, or cryptocurrency services. Fake application (Source – Malwarebytes) Unlike a noisy pop-up campaign, GhostDesk is designed to run in the background, leaving victims unaware that browser data may be exposed. Fake CCleaner Download Delivers GhostDesk The counterfeit installer uses the CCleaner name and icon, but its internal name and original filename do not match known releases. It drops Windows Script Host’s CScript component, gathers basic device details, and replaces a Runtime Broker library with a loader for the next stage. It then alters Chrome’s Security Extension manifest so two scripts, content.js and background.js, load from a local folder when the browser starts. This technique echoes the risk described in  malicious extension backdoor campaign , where a rogue add-on can establish enduring browser access. The altered extension calls itself GhostDesk, a label also used by legitimate screen-overlay software. That naming choice may make its screen capture role appear less unusual, but the reported functions point to surveillance rather than a normal browser tool. Malicious Chrome extension (Source – Malwarebytes) GhostDesk records entries typed into form fields and looks for submitted data tied to credentials, authentication tokens, and financial information. It can also replace pasted cryptocurrency addresses, a tactic that could redirect a payment without changing what a victim intended to do. Browser Spyware Raises Stakes The background component can collect browser cookies, capture the active tab, maintain a local relay, and inject attacker-provided JavaScript into an open page. Such broad permissions show why  reviewing browser extension permissions  should be part of routine account protection, especially on devices used for sensitive work. The malware connects through a local WebSocket endpoint before reaching attacker infrastructure, allowing data and instructions to move between Chrome and the operator. Comparable campaigns have used browser add-ons to quietly gather data at scale, including the  long-running ShadyPanda extension campaign , which relied on trusted-looking extensions. Researchers also traced the same loading method to fake 7-Zip and Adobe Acrobat samples, with all observed samples communicating with the same command-and-control domain. One fake Adobe Acrobat variant used wscript.exe rather than cscript.exe, suggesting the operators can adjust the loader while keeping the broader delivery chain intact. Anyone who downloaded the suspected installer should disconnect the machine from sensitive accounts, run a reputable security scan as soon as possible, and remove unfamiliar Chrome extensions. They should also change passwords from a known-clean device, invalidate all account sessions where possible, and watch for unusual sign-ins or unauthorized transactions. Because stolen cookies can bypass a password alone, prompt session revocation matters alongside credential resets. Users should check the address bar carefully before downloading software and avoid treating sponsored results, social posts, text messages, or emailed links as proof that a download is official. When available, obtain software through the publisher’s legitimate site or a trusted store, keep Windows and Chrome updated, and review recent extensions for anything unfamiliar. The recent  fake GoogleTranslate extension case  is another reminder that a familiar name can hide tools built to steal browser data and remotely control sessions. Indicators of Compromise (IoCs):- Type Indicator Description Domain ccleanerwind[.]top Fake CCleaner download website Domain liderongrade.duckdns[.]org Command-and-control server IP Address 193.169.240[.]81 Command-and-control server SHA-256 c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23 FakeCCleaner.exe SHA-256 8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904 Reflexive loader replacing runtimebroker.dll SHA-256 3d7411e2e445a2210dbbf061f3e8e3dd3476a4fc5d4a2135dcceb0bc705776bf content.js GhostDesk extension SHA-256 cfd9c0bcc89ebc68aae889b9b49bc8290c3764bce5f2c9ac8b5ba0ba58e9bf61 background.js GhostDesk extension SHA-256 590b04e35fc0b3dcd9dabe82f2e96d4d1e0fccc598911cf80f8255232ee75fcb Fake 7-Zip sample SHA-256 ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d Fake Adobe Acrobat sample SHA-256 cfa3900cefb447d89a7498224f2ecafa65b190336934811e6c1d4196d9b92452 Fake Adobe Acrobat sample SHA-256 0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56 Fake Adobe Acrobat sample using wscript.exe Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Stop new phishing & malware before they compromise your business.  Integrate live intel from 15K SOCs around the world The post Fake CCleaner Download Installs GhostDesk Chrome Spyware on Windows PCs appeared first on Cyber Security News .

A counterfeit CCleaner download is enough to turn Chrome into a surveillance tool. The installer carries a Trojan.Dropper that stages GhostDesk and an extension whose background.js and content.js files harvest credentials from browsing sessions.

A fake CCleaner installer is being used to deliver the GhostDesk Chrome extension, which steals credentials, cookies, screenshots, and keystrokes from Windows users. The campaign also uses lookalike fake apps such as 7-Zip and Adobe Acrobat, all connecting to the same command-and-control infrastructure to spread the spyware payload. #CCleaner #GhostDesk #Chrome...

Een misleidende campagne, die zich voordoet als de populaire software CCleaner, heeft geleid tot de installatie van de kwaadaardige Chrome-extensie GhostDesk, die is ontworpen om gevoelige gebruikersinformatie te stelen. De operatie begint met een valse website (ccleanerwind[.]top) die gebruikers naar een nagemaakte downloadpagina lokt met de naam en het icoon van CCleaner. Beide downloadopties op deze site leiden naar hetzelfde schadelijke uitvoerbare bestand. Het gedownloade bestand installeert GhostDesk, een kwaadaardige extensie die browseractiviteit monitort. De nagemaakte installer, hoewel deze de naam en het icoon van CCleaner gebruikt, heeft interne namen en oorspronkelijke bestands...

サイバー犯罪者が偽のCCleanerインストーラーを使い、Windowsユーザーに悪意のあるChrome拡張機能「GhostDesk」を感染させています。この拡張機能は、閲覧履歴を監視し、機密情報を盗み出すよう設計されています。 CCleanerは世界中で20億回以上ダウンロードされている、最も広く知られたPCクリー

A Familiar Name Used as a Dangerous Disguise Cybercriminals have once again demonstrated why trust can be just as valuable as a technical exploit. In a newly observed campaign, attackers are abusing the reputation of CCleaner, one of the world's best-known Windows cleaning utilities, to distribute a malicious Chrome extension called GhostDesk. The campaign is particularly concerning because it does not rely on an obviously suspicious application, a bizarre filename, or a complicated social-engineering story.

A convincing fake version of the widely used CCleaner utility is being used to deliver a multi-stage Windows malware that ultimately abuses Google Chrome for credential theft and surveillance. Researchers from Malwarebytes found the campaign distributing a malicious Chrome extension called GhostDesk, which can capture credentials, cookies, keystrokes, and screenshots while also allowing attackers to inject arbitrary JavaScript into active browser tabs. Attackers created a lookalike CCleaner download site and used it to distribute a malicious “CCleaner.exe,” researcher Sav Wheeler said in a blog post. Alongside GhostDesk, the researchers also identified fake 7-zip and Adobe Acrobat applications using the same techniques and command-and-control (C2) infrastructure. CCleaner is a popular Windows PC cleaner utility, with more than 2 billion downloads worldwide. Wheeler said “the executable (fake CCleaner) initially drops a legitimate instance of CScript, then uses it to launch a series of (malicious) scripts.” ## A fake cleaner with a multi-stage payload The attack begins when a victim downloads the fake CCleaner executable file from the impersonated site “ccleanerwind[.]top.” Malwarebytes found that both the site’s regular and “Cleaner Pro” download buttons delivered the same malicious file. When executed, “cscript.exe” runs a series of scripts carrying out basic system reconnaissance like collecting the machine GUID, hostname, and supported languages. It then replaces “runtimebroker.dll” in the user’s AppData directory with a reflexive loader and modifies Chrome’s Security Extension manifest. This modification allows the attacker to inject two JavaScript files, “background.js” and “content.js,” that run as a malicious extension whenever Chrome starts. The resulting malware Malwarebytes tracks as GhostDesk. While content.js was seen recording keystrokes and scanning submitted forms for credentials, authentication tokens, and financial information, background.js provided cookie theft, screenshot capture, and arbitrary JavaScript execution. content.js was also found capable of monitoring clipboard activity and replacing cryptocurrency addresses when victims paste them into websites. background.js provides persistence as it communicates through a WebSocket relay and can re-establish that connection when Chrome starts, Wheeler pointed out. ## The campaign is bigger than GhostDesk The campaign’s impact was traced beyond users who specifically searched for CCleaner. Malwarebytes found fake 7-zip and Adobe Acrobat samples using the same CScript loading mechanism, with the samples communicating with the same C2 at “liderongrade.duckdns[.]org.” The only difference observed was some Adobe samples using “wscript.exe” instead of cscript.exe, likely attackers attempting to adapt delivery to different software, Wheeler noted. The combination of browser cookies, credentials, keystrokes and screen captures makes the compromise concerning for enterprises and worth setting protections against. Captured authentication tokens and financial information add further risk. Malwarebytes recommended checking the web address carefully before downloading software, noting that sponsored search results can be abused by cybercriminals. It also advised treating software download links shared through social media, SMS and email with caution, and verifying downloads against trusted sources such as the publisher’s official website or app stores. The company also recommended using an up-to-date, real-time anti-malware solution with web protection. The one from Malwarebytes blocks connections to unsafe sites such as the fake CCleaner landing page and detects the fake installer as “Trojan.Dropper,” it added. Keeping the operating system, browser, and security software up to date remains a must.

広く使われているPC最適化ツール「CCleaner」の偽インストーラーがWindowsシステムの侵害に悪用され、GhostDeskと呼ばれる悪質なChrome拡張機能を展開していることが分かりました。 CCleanerは世界で20億回以上ダウンロードされている人気ツールであり、この知名度の高さが攻撃者にとって、システ

A convincing fake CCleaner website delivers a multi-stage malware attack that installs a spyware extension inside Chrome.

A convincing fake CCleaner website delivers a multi-stage malware attack that installs a spyware extension inside Chrome.

人気のPCクリーニングツール「CCleaner」の偽バージョンが、Windowsユーザーに「GhostDesk」と呼ばれる悪質なChrome拡張機能を感染させるために利用されています。この拡張機能はブラウザ内でスパイウェアとして動作します。 CCleanerは全世界で20億ダウンロード以上を誇るWindows向け