Cybercriminals are using a fake CCleaner installer to infect Windows users with GhostDesk, a malicious Chrome extension designed to spy on browsing activity and steal sensitive information.
CCleaner is one of the most widely recognized PC-cleaning utilities, with more than 2 billion downloads worldwide. Its popularity makes it a valuable lure for threat actors, who can abuse user trust in the brand to deliver malware through convincing download pages.
The campaign uses a fraudulent website, ccleanerwind[.]top, made to resemble the legitimate CCleaner website. The page reportedly offers both normal and CCleaner Pro download options, but each button delivers the same malicious executable.
The downloaded file is named CCleaner.exe and uses the real application’s icon. However, it contains unusual metadata that does not match known legitimate CCleaner releases.
Its internal name is svc_it7p, while its original filename is rt_mxk.exe. Researchers also identified similarly named files following the patterns svc_<four random characters> and rt_<three random characters>.exe.
Once executed, the fake cleaner starts a multi-stage infection chain that modifies Google Chrome and installs spyware components.
The campaign uses the trusted appearance of a PC utility to make its file activity less likely to raise suspicion.
Fake CCleaner Spreads GhostDesk
The fake CCleaner executable first drops and launches a legitimate Windows scripting component, cscript.exe. It then uses scripts to collect system information, including the machine GUID, device name, and supported language settings.
The malware also replaces a file at %AppData%\Microsoft\DriverStore\runtimebroker.dll with a reflexive loader. This component helps load additional malicious code on the compromised system.
A key part of the attack involves modifying Chrome’s Security Extension manifest file.
The malware patches manifest.json to add a background service worker named background.js and a content script named content.js. These files are stored in %LocalAppData%\cse.
The infection also establishes communication with attacker-controlled infrastructure. It creates a local WebSocket endpoint at 192.168.100.4:49727, then connects to the command-and-control server liderongrade.duckdns[.]org on port 4444. This channel allows the malware to receive commands and send stolen information.
The final browser payload identifies itself as GhostDesk, a name that may be intended to blend in with legitimate screen-overlay software. Chrome loads background.js silently when the browser starts, while content.js monitors activity on visited pages.
The content.js component records keystrokes entered into web forms. It stores typed data in a buffer and forwards it for processing after two seconds of inactivity or when the victim switches to another field, malwarebytes said.
Indicators of Compromise
| IOC Type | Indicator | Description |
|---|---|---|
| Domain | ccleanerwind[.]top | Fake CCleaner download website |
| Domain | liderongrade.duckdns[.]org | Command-and-cont |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
