Fake CCleaner Installer Deploys GhostDesk Chrome Spyware to Steal Credentials, Cookies and Keystrokes
Brief
Cybercriminals are using a fake CCleaner installer to infect Windows users with GhostDesk, a malicious Chrome extension designed to spy on browsing activity and steal sensitive information.
CCleaner is one of the most widely recognized PC-cleaning utilities, with more than 2 billion downloads worldwide. Its popularity makes it a valuable lure for threat actors, who can abuse user trust in the brand to deliver malware through convincing download pages.
The campaign uses a fraudulent website, ccleanerwind[. ]top , made to resemble the legitimate CCleaner website. The page reportedly offers both normal and CCleaner Pro download options, but each button delivers the same malicious executable.
The downloaded file is named CCleaner. exe and uses the real application’s icon. However, it contains unusual metadata that does not match known legitimate CCleaner releases.