Published on August 12, 2026
Malicious CCleaner Installer Patches Chrome Security Extension to Deploy Browser Spyware
Severity
Medium
A malicious campaign is abusing the popularity of CCleaner by distributing a counterfeit installer designed to compromise Windows systems and deploy a spyware component known as GhostDesk. The attackers operate a fake download website, ccleanerwind[.]top, which closely imitates the legitimate CCleaner portal and provides both standard and Pro download options. However, both downloads deliver the same trojanized executable.
The payload is named CCleaner.exe and uses a legitimate-looking icon, but its metadata contains unusual values, including an internal name of svc_it7p and an original filename of rt_mxk.exe. Other observed samples follow similar naming patterns, suggesting the use of a repeatable malware-building or distribution framework.
GhostDesk tampers with Chrome’s security extension environment and converts it into a surveillance mechanism. Its capabilities include credential theft, keylogging, browser data collection, screenshot capture, clipboard monitoring, cookie theft, and JavaScript injection. The malware can also target cryptocurrency wallet addresses and replace copied wallet strings with attacker-controlled addresses.
How?
The infection begins when a victim downloads and executes the fake CCleaner installer from the malicious website. The installer drops a legitimate cscript.exe from Windows Script Host and abuses it to execute a series of scripts.
The scripts conduct initial reconnaissance by collecting information such as the machine GUID, hostname, and supported system languages. The malware then places a malicious runtimebroker.dll in %AppData%\Microsoft\DriverStore\, which acts as a loader for additional components.
The malware subsequently modifies Chrome’s manifest.json to introduce a malicious service worker, background.js, and a content script, content.js, located under %LocalAppData%\cse. When Chrome launches, background.js operates in the background while content.js is injected into visited webpages.
The content script monitors web activity, records keystrokes entered into forms, observes POST requests and submissions for credentials, authentication tokens, and financial information, and monitors clipboard contents for cryptocurrency addresses. It can also alter webpage elements and execute injected JavaScript.
The background component handles configuration, persistence, and data exfiltration. It establishes a local WebSocket relay at 127.0.0.1:7345/ext and communicates with attacker-controlled infrastructure, including liderongrade.duckdns[.]org:4444. Additional capabilities include browser cookie theft, active-tab screenshots, and arbitrary JavaScript execution.
Recommendation
Defenders should block the identified malicious domains and C2 infrastructure, investigate systems for the suspicious executable names and file paths, and inspect Chrome extension manifests for unauthorized modifications. Potentially affected users should have their browser sessions terminated and credentials or tokens reset where exposure is suspected.
Endpoint protection solutions should be updated to detect the fake CCleaner installer, which has reportedly been identified as Trojan.Dropper. Organizations should also enforce browser policies that prevent unauthorized extensions from being installed or modified.
Users should obtain CCleaner and other software exclusively from official publisher websites or trusted distribution channels. Suspicious domains, sponsored search results, social-media links, SMS messages, and unsolicited email attachments should be treated with caution.
IOCs
| Type | Indicator | Description |
| Domain | ccleanerwind[.]top | Fake CCleaner download website |
| Domain | liderongrade[.]duckdns[.]org | Command-and-control server |
| IP Address | 193.169.240[.]81 | Command-and-control server |
| SHA-256 | c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23 | Fake CCleaner.exe payload |
| SHA-256 | 8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904 | Malicious loader replacing runtimebroker.dll |
Source