Fake CCleaner Installer Distributes GhostDesk Spyware in Targeted Campaign Cybercriminals are exploiting the popularity of CCleaner a widely trusted PC-cleaning utility with over 2 billion downloads to distribute GhostDesk, a malicious Chrome extension designed to spy on browsing activity and steal sensitive data. The attack begins with a fraudulent website, ccleanerwind[.]top, which mimics the legitimate CCleaner download page. Visitors are presented with options for both the free and Pro versions of the software, but all download buttons deliver the same malicious executable CCleaner.exe disguised with the real application’s icon. However, the file’s metadata reveals inconsistencies, including an internal name (svc_it7p) and original filename (rt_mxk.exe) that differ from authentic CCleaner releases. Researchers have also identified similarly named variants following patterns like svc_<four random characters> and rt_<three random characters>.exe. Once executed, the fake installer initiates a multi-stage infection chain that modifies Google Chrome and deploys spyware components. The malware first drops and runs cscript.exe, a legitimate Windows scripting tool, to gather system details such as the machine GUID, device name, and language settings. It then replaces a file at %AppData%\Microsoft\DriverStore\runtimebroker.dll with a reflexive loader, enabling the execution of additional malicious code. A critical step in the attack involves tampering with Chrome’s Security Extension manifest file (manifest.json). The malware injects two scripts background.js (a background service worker) and content.js (a content script) stored in %LocalAppData%\cse. These components establish persistence and facilitate data exfiltration. The infection also sets up command-and-control (C2) communication, creating a local WebSocket endpoint at 192.168.100.4:49727 before connecting to the attacker-controlled domain liderongrade.duckdns[.]org on port 4444. This channel allows the malware to receive instructions and transmit stolen information. The final payload, GhostDesk, masquerades as legitimate screen-overlay software. When Chrome launches, background.js loads silently, while content.js monitors and logs keystrokes entered into web forms. Captured data is buffered and sent to the C2 server after two seconds of inactivity or when the user switches fields. The campaign leverages CCleaner’s reputation to evade suspicion, underscoring the risks of trust-based social engineering in malware distribution. Indicators of compromise include the fraudulent domain ccleanerwind[.]top and the C2 domain liderongrade.duckdns[.]org.