Fake CCleaner Download Installs GhostDesk Chrome Spyware on Windows PCs
Brief
Windows users looking for a familiar cleanup utility are being steered toward a convincing counterfeit download page.
The file they receive installs GhostDesk, a malicious Chrome extension built to watch activity inside the browser.
The campaign turns a routine software download into a pathway for credential theft, keystroke capture, screenshots, cookie collection, and commands delivered to browser tabs.
Its use of a trusted application name shows why a polished page and familiar icon cannot establish that a download is safe.
Malwarebytes said in a report shared with Cyber Security News (CSN) that the operation begins with a fake CCleaner site and proceeds through a multi-stage Windows infection.
The researchers found the lure at ccleanerwind[.]top, where both displayed download choices served the same harmful executable.