Fake CCleaner Download Installs GhostDesk Chrome Spyware on Windows PCs

Cybersecuritynews •Tushar Subhra Dutta • August 12, 2026

Windows users looking for a familiar cleanup utility are being steered toward a convincing counterfeit download page. The file they receive installs GhostDesk, a malicious Chrome extension built to watch activity inside the browser. The campaign turns a routine software download into a pathway for credential theft, keystroke capture, screenshots, cookie collection, and commands delivered […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fake CCleaner Installer Distributes GhostDesk Spyware via Chrome A malicious version of the popular CCleaner utility is being used to install GhostDesk, a Chrome extension that steals credentials and monitors user activity. The attack begins when users download the counterfeit CCleaner from a fake site, ccleanerwind[.]top. This installer executes scripts that modify Chrome's security settings, allowing the malware to capture keystrokes, cookies, and screenshots. The campaign has been linked to additional fake applications, including 7-zip and Adobe Acrobat, indicating a broader distribution strategy. Malwarebytes researchers have identified the malicious scripts and their capabilities, raising concerns for enterprise security. With over 2 billion downloads of CCleaner globally, the attack targets a wide range of users seeking system maintenance tools. The ongoing threat is significant, given the sensitive data that can be compromised. 4 sources 68

Extracted Entities

Fake CCleaner Download Installs GhostDesk Chrome Spyware on Windows PCs

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)