Fake CCleaner sites push Chrome spyware

Cybercriminals are using a convincing fake version of the popular CCleaner utility to slip a malicious Chrome extension onto Windows machines, according to a new report from Malwarebytes. The extension, which the company tracks as GhostDesk, can steal credentials, cookies, keystrokes, and screenshots, and even inject arbitrary JavaScript into active browser tabs. The campaign, detailed by Malwarebytes researcher Sav Wheeler, highlights how trusted software names are being repurposed to deploy multi-stage malware.

Fake download site tricks victims

The attack begins when a user visits the impersonated site “ccleanerwind[.]top,” which presents itself as a legitimate CCleaner download source. Both the site's regular and “Cleaner Pro” download buttons deliver the same malicious executable, Malwarebytes found. The researchers also identified fake 7-zip and Adobe Acrobat applications using the same techniques and command-and-control (C2) infrastructure, indicating a broader effort beyond CCleaner users.

Multi-stage payload unfolds

When executed, the fake CCleaner installer drops a legitimate instance of CScript, a Windows scripting host, and then uses it to launch a series of malicious scripts. Wheeler explained that “the executable (fake CCleaner) initially drops a legitimate instance of CScript, then uses it to launch a series of (malicious) scripts.” These scripts perform basic system reconnaissance, collecting the machine GUID, hostname, and supported languages.

Chrome extension installs stealthily

The malware then replaces “runtimebroker.dll” in the user's AppData directory with a reflexive loader and modifies Chrome's Security Extension manifest. This alteration allows the attacker to inject two JavaScript files, “background.js” and “content.js,” which run as a malicious extension whenever Chrome starts. This is how GhostDesk establishes its presence.

What GhostDesk can steal

The extension is a potent surveillance tool. While content.js was seen recording keystrokes and scanning submitted forms for credentials, authentication tokens, and financial information, background.js provided cookie theft, screenshot capture, and arbitrary JavaScript execution. content.js was also found capable of monitoring clipboard activity and replacing cryptocurrency addresses when victims paste them into websites.

background.js provides persistence as it communicates through a WebSocket relay and can re-establish that connection when Chrome starts, Wheeler pointed out.

Broader campaign beyond CCleaner

The campaign's impact was traced beyond users who specifically searched for CCleaner. Malwarebytes found fake 7-zip and Adobe Acrobat samples using the same CScript loading mechanism, with the samples communicating with the same C2 at “liderongrade.duckdns[.]org.” The only difference observed was some Adobe samples using “wscript.exe” instead of cscript.exe, likely attackers attempting to adapt delivery to different software, Wheeler noted.

Protecting against fake downloads

Malwarebytes recommended checking the web address carefully before downloading software, noting that sponsored search results can be abused by cybercriminals. It also advised treating software download links shared through social media, SMS, and email with caution, and verifying downloads against trusted sources such as the publisher's official website or app stores. The company also recommended using an up-to-date, real-time anti-malware solution with web protection, noting that its own solution blocks connections to unsafe sites and detects the fake installer as “Trojan.Dropper.”

Why this matters for enterprises

The combination of browser cookies, credentials, keystrokes, and screen captures makes the compromise concerning for enterprises. Captured authentication tokens and financial information add further risk, potentially allowing attackers to bypass multi-factor authentication or drain accounts. This campaign underscores the need for vigilance when downloading software, as even well-known utilities like CCleaner—with more than 2 billion downloads worldwide—can be impersonated to deliver stealthy surveillance tools. For IT teams, this could mean reinforcing policies around software downloads and ensuring endpoint protection is configured to detect such dropper-based attacks.