Fake CCleaner Download Is Installing GhostDesk Spyware Inside Chrome — Here's What SOC Teams Need to Know
It's 9:47 PM on a Tuesday. A help desk ticket comes in: "My CCleaner stopped working and Chrome is acting weird." Nine times out of ten, that's a user complaint you close in five minutes. This time, it isn't.
Somewhere between the download click and the "Optimization complete" popup, an attacker quietly rewrote the victim's Chrome security policy, dropped two JavaScript files into a hidden extension folder, and opened a live channel to a command-and-control server. No warning banner. No antivirus prompt. Just a working CCleaner icon on the desktop — and a spyware operator sitting inside the browser tab where the victim logs into their bank.
This is the real shape of the fake CCleaner GhostDesk campaign that security researchers at Malwarebytes disclosed in August 2026, and it's a textbook case of why "the icon looks right" has never been a security control.
Table of Contents
- What Happened: The Fake CCleaner Campaign
- Inside the Infection Chain: How GhostDesk Gets In
- How GhostDesk Hijacks Chrome's Security Extension
- What GhostDesk Actually Steals
- Indicators of Compromise (IOCs)
- Detection: Hunting for GhostDesk on Your Network
- Prevention: Closing the Door Before It Opens
- Expert Tips From the SOC Floor
- Related Reading
- FAQ
- Conclusion
What Happened: The Fake CCleaner Campaign
CCleaner is one of the most recognized PC utilities on the planet, with more than 2 billion cumulative downloads. That kind of brand trust is exactly what makes it a prime target for malvertising and typosquatting operations — attackers don't need to convince anyone that CCleaner is safe; they just need to convince them they've landed on the real download page.
According to Malwarebytes' threat intelligence team, the current campaign is built around a lookalike domain, ccleanerwind[.]top, designed to closely mirror the official CCleaner.com layout. The page even offers two download options — a standard version and a "Pro" version — as a legitimacy cue. In reality, both buttons deliver the exact same malicious executable.
The downloaded file is named CCleaner.exe and uses the legitimate application's icon, but a look under the hood immediately gives it away. Its internal metadata shows an internal name of svc_it7p and an original filename of rt_mxk.exe — neither of which corresponds to any real CCleaner release. Researchers also found related samples following a repeatable naming pattern (svc_<4 random chars> and rt_<3 random chars>.exe), suggesting the attackers are running this through an automated builder rather than hand-crafting each payload.
Inside the Infection Chain: How GhostDesk Gets In
What makes this campaign notable isn't a novel exploit — it's a disciplined, multi-stage abuse of legitimate Windows components, which is exactly the kind of "living off the land" behavior that slips past signature-based tools.
- Execution and masquerading: The fake installer launches and presents itself as a normal CCleaner setup, reducing user suspicion.
- Living-off-the-land scripting: It drops a legitimate copy of Windows Script Host's
cscript.exeand uses it to run a chain of scripts rather than executing raw shellcode directly — a technique that blends into normal admin activity. - System reconnaissance: Those scripts query the registry for the machine GUID, device name, and installed language packs — basic fingerprinting used to profile the victim and possibly filter out sandboxes or analyst VMs.
- Persistence via component replacement: The malware overwrites
%AppData%\Microsoft\DriverStore\runtimebroker.dllwith a reflexive loader. This isn't the real Windows Runtime Broker — it's a malicious stand-in used to load the next stage without dropping an obvious new executable. - Browser weaponization: The loader modifies Chrome's Security Extension manifest (
manifest.json) to register two new files —content.jsandbackground.js— stored locally under%LocalAppData%\cse. These load automatically every time Chrome starts.
The end result is a spyware extension that never appears in the Chrome Web Store, never asks for install confirmation, and loads silently on every browser launch.
How GhostDesk Hijacks Chrome's Security Extension
The final payload identifies itself internally as GhostDesk — a name that also belongs to a legitimate screen-overlay tool used by some AI agent frameworks to view and interact with a user's screen. Researchers believe the naming overlap is intentional: if an analyst or a curious user spots the extension name, it looks like something benign rather than a credential harvester.
Once active, background.js runs persistently as a service worker, while content.js injects into every page the victim visits. Together they establish a local WebSocket relay before reaching out to the attacker's command-and-control infrastructure, giving the operator a live channel to send commands into the browser and pull data back out — including the ability to inject arbitrary JavaScript into open tabs.
Because it operates entirely inside Chrome's own extension framework rather than as a separate suspicious process, GhostDesk blends into normal browser telemetry far better than a standalone infostealer binary.
What GhostDesk Actually Steals
This isn't a noisy adware campaign. GhostDesk was built for quiet, long-term surveillance of a victim's browsing session. Confirmed capabilities include:
- Keystroke logging — capturing data typed into web forms, including login pages.
- Credential and token harvesting — specifically watching for submitted data tied to usernames, passwords, and authentication tokens.
- Cookie theft — stealing session cookies, which can let an attacker bypass MFA entirely by hijacking an already-authenticated session rather than needing the password at all.
- Screenshot capture — grabbing the contents of the active tab on command.
- Clipboard hijacking for crypto theft — detecting when a victim copies a cryptocurrency wallet address and silently swapping it for an attacker-controlled address, redirecting funds without the victim noticing anything changed on their end.
- Remote script injection — executing attacker-supplied JavaScript inside open browser tabs via the local relay.
Researchers also identified fake 7-Zip and Adobe Acrobat installers using the identical CScript-based loading chain and connecting to the same command-and-control infrastructure — including one Adobe Acrobat variant that used wscript.exe instead of cscript.exe, showing the operators can swap loader components while keeping the rest of the delivery chain intact. This points to a reusable malware-delivery framework rather than a one-off CCleaner spoof.
Indicators of Compromise (IOCs)
| Type | Indicator | Description |
|---|---|---|
| Domain | ccleanerwind[.]top | Fake CCleaner download website |
| Domain | liderongrade.duckdns[.]org | Command-and-control server |
| IP Address | 193.169.240[.]81 | Command-and-control server |
| SHA-256 | c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23 | Fake CCleaner.exe |
| SHA-256 | 8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904 | Reflexive loader replacing runtimebroker.dll |
| SHA-256 | 3d7411e2e445a2210dbbf061f3e8e3dd3476a4fc5d4a2135dcceb0bc705776bf | content.js (GhostDesk extension) |
| SHA-256 | cfd9c0bcc89ebc68aae889b9b49bc8290c3764bce5f2c9ac8b5ba0ba58e9bf61 | background.js (GhostDesk extension) |
| SHA-256 | 590b04e35fc0b3dcd9dabe82f2e96d4d1e0fccc598911cf80f8255232ee75fcb | Fake 7-Zip sample |
| SHA-256 | ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d | Fake Adobe Acrobat sample |
| SHA-256 | cfa3900cefb447d89a7498224f2ecafa65b190336934811e6c1d4196d9b92452 | Fake Adobe Acrobat sample |
| SHA-256 | 0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56 | Fake Adobe Acrobat sample (wscript.exe variant) |
Note: Domains/IPs above are written in defanged format (e.g., [.]) intentionally. Re-fang them only inside a controlled threat-intel platform such as your SIEM, MISP, or VirusTotal before blocking.
Detection: Hunting for GhostDesk on Your Network
If you're running a SOC or just want to check your own machine, here's where to look. None of these require exotic tooling — this is standard triage.
1. Check for the modified Runtime Broker file
Look for an unexpected or recently modified file at:
%AppData%\Microsoft\DriverStore\runtimebroker.dllThe legitimate Runtime Broker lives in System32, not AppData. A file at this path is a strong red flag on its own.
2. Inspect the local extension folder
dir "%LocalAppData%\cse"Look for content.js and background.js. This folder name and structure is not a default Chrome location.
3. Review Chrome's extension manifest
Compare the Security Extension's manifest.json against a known-clean baseline. Any unauthorized entries referencing local scripts loading on startup should be treated as suspicious.
4. Hunt for CScript-spawned child processes
In EDR or Sysmon Event ID 1 (Process Creation) logs, hunt for cscript.exe spawned from an installer or setup executable shortly before browser configuration changes. Legitimate installers rarely need to invoke the Windows Script Host this way.
5. Watch outbound connections to DuckDNS-style domains
Dynamic DNS services like DuckDNS are popular with commodity malware operators because they're free and hard to attribute. Outbound traffic from a browser process to a .duckdns.org subdomain, especially over a non-standard port, warrants investigation.
Prevention: Closing the Door Before It Opens
- Download only from the vendor's official domain. Bookmark it. Don't trust sponsored search ads, social media links, SMS messages, or emailed download links, even if they look convincing.
- Verify the address bar before clicking Download. A polished page and a familiar icon prove nothing about legitimacy.
- Block known IOCs at the perimeter. Push the domains and IP above into your firewall, proxy, and DNS filtering.
- Enforce application allowlisting where feasible, particularly on endpoints used for financial or administrative work.
- Restrict silent extension installation. Enterprise Chrome policies (
ExtensionInstallBlocklist/ExtensionSettings) can prevent unauthorized manifest changes from taking effect. - Keep Windows and Chrome fully patched — this reduces the attack surface the loader can exploit for follow-on stages.
- Educate users on the "two billion downloads" trap. Popular software brand names are used specifically because employees assume popularity equals safety.
If a machine in your environment already downloaded the suspected installer, treat it as a live incident, not routine cleanup:
- Disconnect the device from sensitive accounts and internal resources immediately.
- Run a full scan with a reputable, up-to-date security tool.
- Remove unfamiliar Chrome extensions and reset the browser profile if needed.
- Change passwords from a separate, known-clean device — never from the potentially compromised machine.
- Invalidate all active account sessions wherever the service allows it, since stolen cookies can bypass a password reset alone.
- Monitor for unusual sign-ins, new OAuth grants, or unauthorized financial transactions for the following weeks.
Expert Tips From the SOC Floor
Tip 1: Don't just alert on the malware binary — alert on the behavior. A CScript process spawned from a freshly downloaded installer, followed within seconds by a change to Chrome's manifest.json, is a detection rule that will catch this family and its future variants, even after the hashes change.
Tip 2: Session-cookie theft is the quiet killer in this attack chain. Teams that only rotate passwords after an incident but skip session invalidation are leaving the front door unlocked while changing the deadbolt.
Tip 3: Treat "reused C2 infrastructure across multiple fake apps" as a pivot point, not a footnote. If your threat intel shows the same domain tied to fake 7-Zip or Adobe Acrobat installers, block it proactively — the campaign is clearly running as a shared delivery framework, not an isolated CCleaner incident.
Related Cybersecurity Topics You Should Explore
- Zoomsday Flaw: Hackers Hijack Zoom Users With Zero Clicks
- SonicWall SMA1000 Flaws Now Fuel Ransomware Attacks – CISA Warns
- HP ThinPro's 'Encrypted' Drives Aren't Actually Safe — Here's Why
- GRR Rapid Response: The Free Google Tool That Hacks 100K PCs Remotely
- One Failed Login, Full Server Takeover: WordPress XSS2Shell
- I Traced a Webshell Using Just 6 Linux Commands — Here's How
- How a Fake Movie File Can Empty Your Bank Account in Seconds
- CaptiveCrunch: How Russian Hackers Turned Hotel Wi-Fi Into a Weapon
- CVE-2026-12935: The TP-Link Bug Every Router Owner Should Fix Now
- Adform Hack Turns Trusted Ad Script Into a Crypto Stealer
- The Security Story Hidden Inside Windows 11's Big Update
- SplitVPN Data Breach: 865K Users Exposed, 'No-Logs' Was a Lie
FAQ
Q: Is the real CCleaner software compromised?
No. This campaign relies on a lookalike website, ccleanerwind[.]top, not a breach of the official CCleaner infrastructure or its real download servers.
Q: How do I know if the CCleaner I downloaded is fake?
Check the file's properties for internal name and original filename metadata. Legitimate CCleaner releases won't show random values like svc_it7p or rt_mxk.exe. When in doubt, delete the file and redownload directly from the verified official domain.
Q: Will my antivirus catch GhostDesk?
Signature-based tools may miss it initially since the loader abuses legitimate Windows components (CScript) and the payload lives inside Chrome's own extension framework rather than as a standalone flagged process. Behavioral detection and EDR are far more reliable here.
Q: Can changing my password alone fix an infection?
No. Because GhostDesk steals session cookies, an attacker can remain logged into your accounts even after a password change unless you also invalidate active sessions.
Q: Are Mac or mobile users affected?
The observed campaign targets Windows PCs and the Chrome browser specifically. There's no current evidence of a macOS or mobile variant, but the same "fake popular software" playbook is regularly reused across platforms, so general vigilance still applies.
Q: What should enterprises do right now?
Push the published IOCs into firewall/DNS/proxy blocklists, hunt for the described CScript and manifest.json behavior across endpoints, and reinforce policy that software must only be sourced from vetted, allowlisted channels.
Conclusion
The fake CCleaner GhostDesk campaign is a reminder that trust in a brand name is not a security boundary — it's exactly what attackers are counting on. A convincing download page, a correct-looking icon, and a familiar filename were enough to get a spyware extension living inside Chrome's own security framework, quietly harvesting credentials, cookies, and even redirecting cryptocurrency payments.
The technical defenses here aren't exotic: verify the source, watch for CScript spawning from installers, monitor manifest.json for unauthorized changes, and treat session-cookie theft as seriously as password theft. But the human factor — clicking the download button because "it's just CCleaner" — is still where most of these incidents start and end.
Seen this campaign hit your environment, or found additional IOCs tied to the same infrastructure? Drop a comment below or share this with your SOC team — the more defenders tracking this cluster, the faster it gets shut down.