> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Fake CCleaner installs GhostDesk Chrome spyware
- URL: https://f4n6.co.uk/security-feed/fake-ccleaner-installs-ghostdesk-chrome-spyware/
- Published: 2026-08-11T22:24:32.000Z
- Updated: 2026-08-11T22:24:32.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

A fake CCleaner installer is being distributed via a typosquat/lookalike domain (`ccleanerwind[.]top`), delivering a multi-stage spyware payload that patches the Chrome Security Extension (CSE) to install a malicious extension dubbed "GhostDesk." The malware provides full browser-session surveillance: keylogging, form-based credential harvesting, cookie theft, clipboard monitoring for cryptocurrency addresses, screenshot capture, and arbitrary JavaScript injection. The campaign extends to fake 7-Zip and Adobe Acrobat installers sharing the same C2 infrastructure. No CISA-KEV exploitation state or CVSS scoring applies; this is a social-engineering-driven malware distribution campaign, not a product vulnerability. EMEA financial services are exposed where users can download software from uncontrolled domains; the credential- and cookie-theft capabilities directly threaten banking session integrity and SSO tokens.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The incident is a user-driven social-engineering compromise delivering third-party spyware; while it may trigger internal ICT incident management processes, no distinctive fact in this item narrows obligations beyond what would be true of any generic endpoint malware event.

## 3\. Technical analysis & attack chain

**Attribution caveat:** No named threat actor is identified in the source material. Attribution is unconfirmed. All technical detail below is single-sourced (Malwarebytes, 2026-08-11); verify before enforcement.

### Attack chain (confirmed steps)

1. **Initial access — fake download site:** User visits `ccleanerwind[.]top`, a convincing imitation of the legitimate `ccleaner.com`. Both "Download" and "CCleaner Pro" buttons serve the same malicious executable. The fake `CCleaner.exe` uses the legitimate application's icon and filename but contains anomalous version metadata: internal name `svc_it7p`, original filename `rt_mxk.exe`. Other samples follow the pattern `svc_<4 random chars>` and `rt_<3 random chars>.exe`.
2. **Stage 1 — CScript loader:** The executable drops a legitimate `cscript.exe` and uses it to execute a series of scripts performing: - **System reconnaissance:** Queries the registry for machine GUID, machine name, and supported languages. - **DLL hijack / reflexive loader:** Writes a malicious DLL to `%AppData%\Microsoft\DriverStore\runtimebroker.dll`, replacing the legitimate Runtime Broker component with a reflexive loader for subsequent malware. - **Chrome Security Extension patch:** Modifies the CSE `manifest.json` to inject a service worker (`background.js`) and content script (`content.js`). These files are dropped into `%LocalAppData%\cse`. - **C2 establishment:** Creates a local WebSocket endpoint at `192.168.100.4:49727` and bridges it to the public C2 at `liderongrade.duckns[.]org:4444`. Sends an initial GET request with a token; receives keep-alive packets.
3. **Stage 2 — GhostDesk extension payload:** Because the CSE manifest is patched, `background.js` runs silently on every Chrome launch and `content.js` executes as the main extension content script. They communicate via `chrome.runtime.sendMessage` and `chrome.runtime.onMessage.addListener`.

### content.js capabilities

- **Keylogging:** Captures keystrokes in input fields into a buffer. Flushes to `background.js` after 2 seconds of inactivity or on field-switch.
- **Form credential harvesting:** Intercepts outgoing POST requests and submit events as a man-in-the-middle. Monitors form fields for keywords related to credentials, authentication tokens, and financial information; exfiltrates matching form contents.
- **Cryptojacking / clipboard monitoring:** Monitors clipboard paste events for cryptocurrency address strings.
- **DOM manipulation:** Dynamically injects `<script>` elements into web pages and replaces page elements.

### background.js capabilities

- **WebSocket relay:** Connects to `127.0.0.1:7345/ext` for bidirectional data/command exchange. Re-establishes the relay on Chrome restart or extension re-install (persistence).
- **Cookie theft:** Calls `chrome.cookies.getAll` and exfiltrates all browser cookies to the relay.
- **Screenshot capture:** `captureTab` function sends a screenshot of the active tab to the relay.
- **Arbitrary JS execution:** `injectJS` function uses `chrome.scripting.executeScript` to run arbitrary JavaScript in the active tab.
- **Configuration storage:** Stores cryptocurrency address patterns, JS injection rules, and toggles for form capture and keylogging.

### Related samples — same C2 (`liderongrade.duckns[.]org`)

- Fake 7-Zip: `590b04e35fc0b3dcd9dabe82f2e96d4d1e0fccc598911cf80f8255232ee75fcb`
- Fake Adobe Acrobat: `cde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d`
- Fake Adobe Acrobat: `fa3900cefb447d89a7498224f2ecafa65b190336934811e6c1d4196d9b92452`

### Variant using `wscript.exe` instead of `cscript.exe`

- Fake Adobe Acrobat: `0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56`

## 4\. Mitigation & containment

### P1 — Within 24 hours

- Block the following domains and IP at network egress, web proxy, and DNS resolver levels:
- `ccleanerwind[.]top`
- `liderongrade.duckns[.]org`
- `193.169.240[.]81`
- Add SHA256 hashes of all identified samples to EDR block lists (see §5).
- Hunt for the presence of `%LocalAppData%\cse` directory and `%AppData%\Microsoft\DriverStore\runtimebroker.dll` across the estate. The legitimate `runtimebroker.dll` resides in `C:\Windows\System32`; any instance in the `%AppData%` path is malicious.
- Search Chrome extensions and installed profiles for the string "GhostDesk" and for unrecognised entries in the CSE manifest.

### P2 — Within 72 hours

- Review proxy and DNS logs for any historical connections to the C2 domains/IP. Pivot to affected hosts for credential rotation and session-token revocation.
- Audit endpoint logs for `cscript.exe` or `wscript.exe` executions originating from `%AppData%` or `%LocalAppData%` paths, particularly those writing to the `DriverStore` or `cse` directories.
- Block `duckdns.org` subdomains at the DNS resolver if not required for business operations (this is a dynamic DNS provider frequently abused for C2).

### P3 — Within 7 days

- Enforce application allow-listing for script interpreters (`cscript.exe`, `wscript.exe`) to prevent execution from non-standard directories.
- Implement web filtering to block software downloads from non-vendor domains. Restrict user access to unapproved software download sites.
- Review Chrome extension management policies. Disable developer mode extensions and enforce extension allow-listing via Group Policy (`ExtensionInstallAllowlist`, `ExtensionInstallBlocklist`).
- Educate users on verifying download URLs; legitimate CCleaner is distributed from `ccleaner.com` only.

## 5\. Indicators of compromise

| Type     | Value                                                            | Confidence | Source       |
| -------- | ---------------------------------------------------------------- | ---------- | ------------ |
| domain   | ccleanerwind\[.\]top                                             | High       | Malwarebytes |
| domain   | liderongrade.duckns\[.\]org                                      | High       | Malwarebytes |
| ipv4     | 193.169.240\[.\]81                                               | High       | Malwarebytes |
| sha256   | c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23 | High       | Malwarebytes |
| sha256   | 8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904 | High       | Malwarebytes |
| sha256   | 3d7411e2e445a2210dbbf061f3e8e3dd3476a4fc5d4a2135dcceb0bc705776bf | High       | Malwarebytes |
| sha256   | cfd9c0bcc89ebc68aae889b9b49bc8290c3764bce5f2c9ac8b5ba0ba58e9bf61 | High       | Malwarebytes |
| sha256   | 590b04e35fc0b3dcd9dabe82f2e96d4d1e0fccc598911cf80f8255232ee75fcb | High       | Malwarebytes |
| sha256   | cde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d  | High       | Malwarebytes |
| sha256   | fa3900cefb447d89a7498224f2ecafa65b190336934811e6c1d4196d9b92452  | High       | Malwarebytes |
| sha256   | 0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56 | High       | Malwarebytes |
| filepath | %AppData%\\Microsoft\\DriverStore\\runtimebroker.dll             | High       | Malwarebytes |
| filepath | %LocalAppData%\\cse                                              | High       | Malwarebytes |

```iocs
domain  ccleanerwind[.]top
domain  liderongrade[.]duckdns[.]org
ipv4  193.169.240[.]81
sha256  c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23
sha256  8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904
sha256  3d7411e2e445a2210dbbf061f3e8e3dd3476a4fc5d4a2135dcceb0bc705776bf
sha256  cfd9c0bcc89ebc68aae889b9b49bc8290c3764bce5f2c9ac8b5ba0ba58e9bf61
sha256  590b04e35fc0b3dcd9dabe82f2e96d4d1e0fccc598911cf80f8255232ee75fcb
sha256  cde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d
sha256  fa3900cefb447d89a7498224f2ecafa65b190336934811e6c1d4196d9b92452
sha256  0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56
filepath  %AppData%\Microsoft\DriverStore\runtimebroker.dll
filepath  %LocalAppData%\cse

```

## 6\. Detection

```yara
rule GhostDesk_Chrome_Spyware {
  meta:
    author = "Adverse Trace"
    date = "2026-08-11"
    reference = "https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware"
    description = "Detects GhostDesk malicious Chrome extension components (content.js, background.js) and fake installer version metadata"

  strings:
    $ext_name = "GhostDesk" ascii
    $cse_path = "cse\\background.js" ascii
    $cse_path2 = "cse\\content.js" ascii
    $dll_path = "DriverStore\\runtimebroker.dll" ascii
    $ws_relay = "127.0.0.1:7345/ext" ascii
    $c2_domain = "liderongrade.duckdns.org" ascii
    $c2_port = ":4444" ascii
    $cookie_api = "chrome.cookies.getAll" ascii
    $capture_tab = "captureTab" ascii
    $inject_js = "injectJS" ascii
    $exec_script = "chrome.scripting.executeScript" ascii
    $send_msg = "chrome.runtime.sendMessage" ascii
    $on_msg = "chrome.runtime.onMessage.addListener" ascii
    $svc_pattern = "svc_" ascii
    $rt_pattern = "rt_" ascii

  condition:
    4 of them
}

```

```yaml
title: GhostDesk Spyware C2 Communication
id: 7a3c1f2e-8b4d-4a6e-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects network connections to GhostDesk C2 infrastructure
author: Adverse Trace
date: 2026/08/11
references:

  - https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware
logsource:
  product: windows
  category: network_connection
detection:
  selection_c2:
    DestinationHostname|contains:

      - "liderongrade.duckdns.org"
    DestinationPort:

      - 4444
  selection_download:
    DestinationHostname|contains:

      - "ccleanerwind.top"
  condition: selection_c2 or selection_download
falsepositives:

  - Unknown
level: high

```

```yaml
title: Suspicious runtimebroker.dll in AppData
id: 8b4d2f3e-9c5e-4b7f-ad6e-2e3f4a5b6c7d
status: experimental
description: Detects runtimebroker.dll written to AppData path, indicating GhostDesk reflexive loader
author: Adverse Trace
date: 2026/08/11
references:

  - https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains:

      - "\\AppData\\Microsoft\\DriverStore\\runtimebroker.dll"
  condition: selection
falsepositives:

  - Unknown
level: high

```

```yaml
title: CScript execution from AppData delivering GhostDesk
id: 9c5e3f4e-ad6f-4c8e-be7f-3f4a5b6c7d8e
status: experimental
description: Detects cscript.exe or wscript.exe execution from non-standard paths associated with GhostDesk loader
author: Adverse Trace
date: 2026/08/11
references:

  - https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware
logsource:
  product: windows
  category: process_creation
detection:
  selection_script:
    Image|endswith:

      - "\\cscript.exe"
      - "\\wscript.exe"
    CommandLine|contains:

      - "\\AppData\\"
  selection_cse_write:
    TargetFilename|contains:

      - "\\LocalAppData\\cse\\"
  condition: selection_script or selection_cse_write
falsepositives:

  - Legitimate administrative scripts running from user profiles (rare)
level: high

```

## 7\. Sources

- Malwarebytes, "Fake CCleaner installs GhostDesk Chrome spyware," https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware, 2026-08-11

## 8\. Adverse Trace position

This is a credible, active social-engineering campaign with high-impact browser spyware capabilities directly relevant to financial services — credential harvesting, cookie theft, and session screenshot capture can defeat MFA and compromise authenticated banking sessions. The technical detail is thorough and internally consistent but single-sourced (Malwarebytes only); we assess the IOCs as reliable for immediate blocking but recommend corroborating the C2 infrastructure before committing to long-term threat-actor attribution. The campaign's use of multiple fake installers (CCleaner, 7-Zip, Adobe Acrobat) sharing a single C2 endpoint suggests a single operator with scalable distribution. Adverse Trace will monitor for C2 infrastructure changes, additional fake installer variants, and any follow-on credential abuse activity. Clients should prioritise P1 network blocks and endpoint hunting for the `runtimebroker.dll` DLL-hijack artefact and the `%LocalAppData%\cse` directory.

---

[Read the original source →](https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*