Someone has built a convincing copy of the CCleaner download page, and anyone who falls for it ends up with a spy sitting inside their browser. Malwarebytes' threat intelligence team says the fake installer quietly modifies Chrome so that a malicious extension, which identifies itself as GhostDesk, starts every time the browser does, logging keystrokes, lifting cookies and swapping out cryptocurrency addresses.
CCleaner is an obvious lure. Malwarebytes notes the Windows utility has more than 2 billion downloads worldwide, which makes a lookalike page plausible to almost anyone. The fake lives at ccleanerwind[.]top and imitates the official home page closely enough that both of its download buttons, including one labeled as the Pro version, hand over the same malicious executable. Details of the campaign are in the original write-up.
What is affected
Windows users who install the fake app. It carries CCleaner's icon and filename but its version metadata gives it away, with an internal name of svc_it7p and an original filename of rt_mxk.exe, neither of which matches any real CCleaner release. Malwarebytes found further samples following the same svc_ and rt_ naming pattern, and says the choice of a PC cleaning tool as the disguise likely helps the malware's file and system activity look less suspicious than it is.
How the attack works
The installer drops a legitimate copy of Windows' own scripting host, cscript.exe, and uses it to run the rest of the chain. That chain queries the registry for the machine identifier, name and languages, replaces a file in the user's profile with a loader for further malware, and then does the unusual part: it patches the manifest of Chrome's Security Extension so the browser loads two attacker-supplied JavaScript files, a background service worker and a content script, as though they belonged there. A local WebSocket endpoint is opened and upgraded into a connection to the operators at liderongrade.duckdns[.]org on port 4444.
The two scripts split the work. The content script records keystrokes typed into input fields and flushes them after a couple of seconds of inactivity, watches outgoing form submissions for keywords tied to credentials, authentication tokens and financial data, and monitors clipboard pastes so that a copied cryptocurrency address can be replaced with the attacker's own. The background script handles exfiltration over a local relay, steals the full cookie jar through Chrome's own cookie API, screenshots the active tab on demand and can run arbitrary JavaScript in whatever page the victim is looking at.
GhostDesk is also the name of a legitimate overlay tool that lets AI agents see and interact with a user's screen. Malwarebytes suggests the borrowed name may help the extension's screen-capture behavior blend in, though it notes the extension makes no attempt to hide its other functions.
What you should do
Download utilities from the publisher's own site or an official store, and treat sponsored search results as untrusted. If a machine ran the fake installer, assume browser-stored credentials, session cookies and any cryptocurrency addresses pasted since then are compromised: reset passwords, invalidate sessions and reinstall the browser rather than just removing the extension. The same infrastructure is serving fake 7-Zip and Adobe Acrobat installers, so this is not a CCleaner-specific problem. It follows a run of similar campaigns, including fake CNN and Avast download pages that handed attackers remote control, and fake Mac download pages that hide from security scanners.
Indicators
Distribution site ccleanerwind[.]top. Command-and-control at liderongrade.duckdns[.]org and 193[.]169[.]240[.]81. The fake CCleaner.exe is c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23, the two extension scripts are 3d7411e2e445a2210dbbf061f3e8e3dd3476a4fc5d4a2135dcceb0bc705776bf and cfd9c0bcc89ebc68aae889b9b49bc8290c3764bce5f2c9ac8b5ba0ba58e9bf61. Malwarebytes detects the installer as Trojan.Dropper.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.