Fake CCleaner Installer Distributes GhostDesk Spyware via Chrome

A malicious version of the popular CCleaner utility is being used to install GhostDesk, a Chrome extension that steals credentials and monitors user activity. The attack begins when users download the counterfeit CCleaner from a fake site, ccleanerwind[.]top. This installer executes scripts that modify Chrome's security settings, allowing the malware to capture keystrokes, cookies, and screenshots. The campaign has been linked to additional fake applications, including 7-zip and Adobe Acrobat, indicating a broader distribution strategy. Malwarebytes researchers have identified the malicious scripts and their capabilities, raising concerns for enterprise security. With over 2 billion downloads of CCleaner globally, the attack targets a wide range of users seeking system maintenance tools. The ongoing threat is significant, given the sensitive data that can be compromised.

Key Points: • A counterfeit CCleaner installer is distributing GhostDesk, a Chrome spyware extension. • The attack modifies Chrome's security settings to enable credential theft and surveillance. • The campaign also includes fake versions of 7-zip and Adobe Acrobat, expanding its reach.