Malicious CCleaner Installer Patches Chrome Security Extension to Deploy Browser Spyware

Gbhackers •Mayura Kathir • August 12, 2026

A counterfeit installer for the widely used PC-cleaning utility CCleaner is being used to compromise Windows systems and deploy a malicious Chrome extension dubbed GhostDesk. CCleaner’s global popularity, with more than two billion downloads, gives attackers a credible pretext to target users searching for system-maintenance tools. The observed infection chain begins at ccleanerwind[.]top, a website […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fake CCleaner Installer Distributes GhostDesk Spyware via Chrome A malicious version of the popular CCleaner utility is being used to install GhostDesk, a Chrome extension that steals credentials and monitors user activity. The attack begins when users download the counterfeit CCleaner from a fake site, ccleanerwind[.]top. This installer executes scripts that modify Chrome's security settings, allowing the malware to capture keystrokes, cookies, and screenshots. The campaign has been linked to additional fake applications, including 7-zip and Adobe Acrobat, indicating a broader distribution strategy. Malwarebytes researchers have identified the malicious scripts and their capabilities, raising concerns for enterprise security. With over 2 billion downloads of CCleaner globally, the attack targets a wide range of users seeking system maintenance tools. The ongoing threat is significant, given the sensitive data that can be compromised. 4 sources 68

Extracted Entities

Malicious CCleaner Installer Patches Chrome Security Extension to Deploy Browser Spyware

The full story

Extracted Entities

Attack Types (2)

Domains (1)

Malware (1)

Platforms (1)