Fake CCleaner installs GhostDesk Chrome spyware

1. Executive summary

A fake CCleaner installer is being distributed via a typosquat/lookalike domain (ccleanerwind[.]top), delivering a multi-stage spyware payload that patches the Chrome Security Extension (CSE) to install a malicious extension dubbed "GhostDesk." The malware provides full browser-session surveillance: keylogging, form-based credential harvesting, cookie theft, clipboard monitoring for cryptocurrency addresses, screenshot capture, and arbitrary JavaScript injection. The campaign extends to fake 7-Zip and Adobe Acrobat installers sharing the same C2 infrastructure. No CISA-KEV exploitation state or CVSS scoring applies; this is a social-engineering-driven malware distribution campaign, not a product vulnerability. EMEA financial services are exposed where users can download software from uncontrolled domains; the credential- and cookie-theft capabilities directly threaten banking session integrity and SSO tokens.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The incident is a user-driven social-engineering compromise delivering third-party spyware; while it may trigger internal ICT incident management processes, no distinctive fact in this item narrows obligations beyond what would be true of any generic endpoint malware event.

3. Technical analysis & attack chain

Attribution caveat: No named threat actor is identified in the source material. Attribution is unconfirmed. All technical detail below is single-sourced (Malwarebytes, 2026-08-11); verify before enforcement.

Attack chain (confirmed steps)

1. Initial access — fake download site: User visits ccleanerwind[.]top, a convincing imitation of the legitimate ccleaner.com. Both "Download" and "CCleaner Pro" buttons serve the same malicious executable. The fake CCleaner.exe uses the legitimate application's icon and filename but contains anomalous version metadata: internal name svc_it7p, original filename rt_mxk.exe. Other samples follow the pattern svc_<4 random chars> and rt_<3 random chars>.exe.
2. Stage 1 — CScript loader: The executable drops a legitimate cscript.exe and uses it to execute a series of scripts performing: - System reconnaissance: Queries the registry for machine GUID, machine name, and supported languages. - DLL hijack / reflexive loader: Writes a malicious DLL to %AppData%\Microsoft\DriverStore\runtimebroker.dll, replacing the legitimate Runtime Broker component with a reflexive loader for subsequent malware. - Chrome Security Extension patch: Modifies the CSE manifest.json to inject a service worker (background.js) and content script (content.js). These files are dropped into %LocalAppData%\cse. - C2 establishment: Creates a local WebSocket endpoint at 192.168.100.4:49727 and bridges it to the public C2 at liderongrade.duckns[.]org:4444. Sends an initial GET request with a token; receives keep-alive packets.
3. Stage 2 — GhostDesk extension payload: Because the CSE manifest is patched, background.js runs silently on every Chrome launch and content.js executes as the main extension content script. They communicate via chrome.runtime.sendMessage and chrome.runtime.onMessage.addListener.

content.js capabilities

• Keylogging: Captures keystrokes in input fields into a buffer. Flushes to background.js after 2 seconds of inactivity or on field-switch.
• Form credential harvesting: Intercepts outgoing POST requests and submit events as a man-in-the-middle. Monitors form fields for keywords related to credentials, authentication tokens, and financial information; exfiltrates matching form contents.
• Cryptojacking / clipboard monitoring: Monitors clipboard paste events for cryptocurrency address strings.
• DOM manipulation: Dynamically injects <script> elements into web pages and replaces page elements.

background.js capabilities

• WebSocket relay: Connects to 127.0.0.1:7345/ext for bidirectional data/command exchange. Re-establishes the relay on Chrome restart or extension re-install (persistence).
• Cookie theft: Calls chrome.cookies.getAll and exfiltrates all browser cookies to the relay.
• Screenshot capture: captureTab function sends a screenshot of the active tab to the relay.
• Arbitrary JS execution: injectJS function uses chrome.scripting.executeScript to run arbitrary JavaScript in the active tab.
• Configuration storage: Stores cryptocurrency address patterns, JS injection rules, and toggles for form capture and keylogging.

Related samples — same C2 (liderongrade.duckns[.]org)

• Fake 7-Zip: 590b04e35fc0b3dcd9dabe82f2e96d4d1e0fccc598911cf80f8255232ee75fcb
• Fake Adobe Acrobat: cde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d
• Fake Adobe Acrobat: fa3900cefb447d89a7498224f2ecafa65b190336934811e6c1d4196d9b92452

Variant using wscript.exe instead of cscript.exe

• Fake Adobe Acrobat: 0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56

4. Mitigation & containment

P1 — Within 24 hours

• Block the following domains and IP at network egress, web proxy, and DNS resolver levels:
• ccleanerwind[.]top
• liderongrade.duckns[.]org
• 193.169.240[.]81
• Add SHA256 hashes of all identified samples to EDR block lists (see §5).
• Hunt for the presence of %LocalAppData%\cse directory and %AppData%\Microsoft\DriverStore\runtimebroker.dll across the estate. The legitimate runtimebroker.dll resides in C:\Windows\System32; any instance in the %AppData% path is malicious.
• Search Chrome extensions and installed profiles for the string "GhostDesk" and for unrecognised entries in the CSE manifest.

P2 — Within 72 hours

• Review proxy and DNS logs for any historical connections to the C2 domains/IP. Pivot to affected hosts for credential rotation and session-token revocation.
• Audit endpoint logs for cscript.exe or wscript.exe executions originating from %AppData% or %LocalAppData% paths, particularly those writing to the DriverStore or cse directories.
• Block duckdns.org subdomains at the DNS resolver if not required for business operations (this is a dynamic DNS provider frequently abused for C2).

P3 — Within 7 days

• Enforce application allow-listing for script interpreters (cscript.exe, wscript.exe) to prevent execution from non-standard directories.
• Implement web filtering to block software downloads from non-vendor domains. Restrict user access to unapproved software download sites.
• Review Chrome extension management policies. Disable developer mode extensions and enforce extension allow-listing via Group Policy (ExtensionInstallAllowlist, ExtensionInstallBlocklist).
• Educate users on verifying download URLs; legitimate CCleaner is distributed from ccleaner.com only.

5. Indicators of compromise

domain  ccleanerwind[.]top
domain  liderongrade[.]duckdns[.]org
ipv4  193.169.240[.]81
sha256  c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23
sha256  8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904
sha256  3d7411e2e445a2210dbbf061f3e8e3dd3476a4fc5d4a2135dcceb0bc705776bf
sha256  cfd9c0bcc89ebc68aae889b9b49bc8290c3764bce5f2c9ac8b5ba0ba58e9bf61
sha256  590b04e35fc0b3dcd9dabe82f2e96d4d1e0fccc598911cf80f8255232ee75fcb
sha256  cde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d
sha256  fa3900cefb447d89a7498224f2ecafa65b190336934811e6c1d4196d9b92452
sha256  0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56
filepath  %AppData%\Microsoft\DriverStore\runtimebroker.dll
filepath  %LocalAppData%\cse

6. Detection

rule GhostDesk_Chrome_Spyware {
  meta:
    author = "Adverse Trace"
    date = "2026-08-11"
    reference = "https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware"
    description = "Detects GhostDesk malicious Chrome extension components (content.js, background.js) and fake installer version metadata"

  strings:
    $ext_name = "GhostDesk" ascii
    $cse_path = "cse\\background.js" ascii
    $cse_path2 = "cse\\content.js" ascii
    $dll_path = "DriverStore\\runtimebroker.dll" ascii
    $ws_relay = "127.0.0.1:7345/ext" ascii
    $c2_domain = "liderongrade.duckdns.org" ascii
    $c2_port = ":4444" ascii
    $cookie_api = "chrome.cookies.getAll" ascii
    $capture_tab = "captureTab" ascii
    $inject_js = "injectJS" ascii
    $exec_script = "chrome.scripting.executeScript" ascii
    $send_msg = "chrome.runtime.sendMessage" ascii
    $on_msg = "chrome.runtime.onMessage.addListener" ascii
    $svc_pattern = "svc_" ascii
    $rt_pattern = "rt_" ascii

  condition:
    4 of them
}

title: GhostDesk Spyware C2 Communication
id: 7a3c1f2e-8b4d-4a6e-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects network connections to GhostDesk C2 infrastructure
author: Adverse Trace
date: 2026/08/11
references:

  - https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware
logsource:
  product: windows
  category: network_connection
detection:
  selection_c2:
    DestinationHostname|contains:

      - "liderongrade.duckdns.org"
    DestinationPort:

      - 4444
  selection_download:
    DestinationHostname|contains:

      - "ccleanerwind.top"
  condition: selection_c2 or selection_download
falsepositives:

  - Unknown
level: high

title: Suspicious runtimebroker.dll in AppData
id: 8b4d2f3e-9c5e-4b7f-ad6e-2e3f4a5b6c7d
status: experimental
description: Detects runtimebroker.dll written to AppData path, indicating GhostDesk reflexive loader
author: Adverse Trace
date: 2026/08/11
references:

  - https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains:

      - "\\AppData\\Microsoft\\DriverStore\\runtimebroker.dll"
  condition: selection
falsepositives:

  - Unknown
level: high

title: CScript execution from AppData delivering GhostDesk
id: 9c5e3f4e-ad6f-4c8e-be7f-3f4a5b6c7d8e
status: experimental
description: Detects cscript.exe or wscript.exe execution from non-standard paths associated with GhostDesk loader
author: Adverse Trace
date: 2026/08/11
references:

  - https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware
logsource:
  product: windows
  category: process_creation
detection:
  selection_script:
    Image|endswith:

      - "\\cscript.exe"
      - "\\wscript.exe"
    CommandLine|contains:

      - "\\AppData\\"
  selection_cse_write:
    TargetFilename|contains:

      - "\\LocalAppData\\cse\\"
  condition: selection_script or selection_cse_write
falsepositives:

  - Legitimate administrative scripts running from user profiles (rare)
level: high

7. Sources

• Malwarebytes, "Fake CCleaner installs GhostDesk Chrome spyware," https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware, 2026-08-11

8. Adverse Trace position

This is a credible, active social-engineering campaign with high-impact browser spyware capabilities directly relevant to financial services — credential harvesting, cookie theft, and session screenshot capture can defeat MFA and compromise authenticated banking sessions. The technical detail is thorough and internally consistent but single-sourced (Malwarebytes only); we assess the IOCs as reliable for immediate blocking but recommend corroborating the C2 infrastructure before committing to long-term threat-actor attribution. The campaign's use of multiple fake installers (CCleaner, 7-Zip, Adobe Acrobat) sharing a single C2 endpoint suggests a single operator with scalable distribution. Adverse Trace will monitor for C2 infrastructure changes, additional fake installer variants, and any follow-on credential abuse activity. Clients should prioritise P1 network blocks and endpoint hunting for the runtimebroker.dll DLL-hijack artefact and the %LocalAppData%\cse directory.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.