Fake CCleaner downloads turn Chrome into a credential-stealing surveillance tool
Brief
A convincing fake version of the widely used CCleaner utility is being used to deliver a multi-stage Windows malware that ultimately abuses Google Chrome for credential theft and surveillance.
Researchers from Malwarebytes found the campaign distributing a malicious Chrome extension called GhostDesk, which can capture credentials, cookies, keystrokes, and screenshots while also allowing attackers to inject arbitrary JavaScript into active browser tabs.
Attackers created a lookalike CCleaner download site and used it to distribute a malicious “CCleaner.exe,” researcher Sav Wheeler said in a blog post .
Alongside GhostDesk, the researchers also identified fake 7-zip and Adobe Acrobat applications using the same techniques and command-and-control (C2) infrastructure.
CCleaner is a popular Windows PC cleaner utility , with more than 2 billion downloads worldwide.