Fake CCleaner site turns Chrome into a spying and password-theft tool
Criminals built a convincing copycat download page for one of the world's most-downloaded PC tools, then used it to silently hijack Google Chrome and steal passwords, bank details, and screenshots.
Key points
- Criminals built a fake CCleaner download site at "ccleanerwind[.]top" and used it to distribute malware disguised as a legitimate installer.
- The malware plants a hidden extension inside Google Chrome called GhostDesk, which records keystrokes, steals cookies, captures screenshots, and swaps cryptocurrency wallet addresses.
- Researchers at Malwarebytes identified copycat sites impersonating 7-Zip and Adobe Acrobat, running the same attack chain against the same criminal server.
- GhostDesk intercepts clipboard contents, so a victim who copies a crypto wallet address may unknowingly paste the attacker's address instead.
- GhostDesk can also inject arbitrary JavaScript into open browser tabs, a capability the draft understated.
What happened?
Someone built a near-identical copy of the CCleaner download page. CCleaner is a Windows utility, downloaded more than two billion times globally, that cleans junk files and speeds up computers. Most visitors would've had no obvious reason to doubt it.
Both download buttons on the fake site delivered the same malicious file. Once a visitor ran the installer, a quiet multi-step attack began. The file dropped a legitimate Windows scripting tool called CScript, which Windows uses to run automated tasks, then used it to execute a chain of hidden scripts. Those scripts gathered basic information about the machine: its GUID (a unique identifier) and hostname. Standard reconnaissance before deciding whether a target is worth pursuing.
The scripts then modified Chrome's Security Extension manifest, the internal document Chrome reads to decide which extensions are allowed to run. That modification let the attackers inject two rogue JavaScript files into the browser. Chrome treated them as a trusted extension. That extension is GhostDesk.
How does the attack actually steal information?
GhostDesk has two components. One records every key a victim types and scans submitted forms for passwords, authentication tokens (the digital passes that keep you logged in without re-entering a password), and financial details. It also watches the clipboard, the temporary storage where text sits after you press copy, and silently replaces any cryptocurrency wallet address with the criminals' own.
The second component steals browser cookies (small files websites use to recognise a returning visitor), takes screenshots, and maintains a live channel back to the criminals' server via a WebSocket relay. That channel restarts automatically each time Chrome opens. Both components can also inject arbitrary JavaScript into active browser tabs, meaning attackers can manipulate what you see on a page in real time.
This campaign sits inside a pattern we've been tracking: our 3 August story on Palo Alto's Unit 42 findings showed how ordinary user-level malware can bypass Google Password Manager entirely, and Chrome's own countermeasures against rogue extensions are still being tested, as we reported on 2 August.
Should anyone other than CCleaner users be worried?
Yes. Malwarebytes found fake sites for 7-Zip, a popular free file-compression tool, and Adobe Acrobat running the same attack chain and reporting back to the same criminal server.
| Fake software | Delivery method | Same server? |
|---|---|---|
| CCleaner | cscript.exe chain | Yes |
| 7-Zip | cscript.exe chain | Yes |
| Adobe Acrobat | wscript.exe chain (variant) | Yes |
All three reported to "liderongrade.duckdns[.]org."
What should you do right now?
Check the web address before downloading anything. The official CCleaner site is piriform.com; any other domain offering it isn't legitimate. Go directly to a publisher's own site rather than clicking a search result.
Be especially cautious with sponsored results, the paid links at the top of a Google or Bing search. Criminals buy those slots to push fake pages to the front. Malwarebytes also flags download links shared through social media, SMS, and email as common delivery paths.
If you've downloaded CCleaner or either of the other targeted tools from an unfamiliar link recently, run a full scan. Malwarebytes detects the fake installer as "Trojan.Dropper" and blocks the criminal server. Change passwords for every account you accessed through Chrome on that machine, and check account activity for unfamiliar logins.
The honest read on this campaign: it's not technically novel. Fake download sites and rogue Chrome extensions are old techniques. What makes this one worth attention is the clipboard-swapping combined with persistent WebSocket access, which turns a one-time download mistake into an ongoing surveillance problem that survives reboots.
