--- title: Fake CCleaner downloads turn Chrome into a... description: A convincing fake CCleaner download site distributes a multi-stage Windows malware that ultimately hijacks Google Chrome via a malicious extension called... canonical: https://daily.dev/posts/fake-ccleaner-downloads-turn-chrome-into-a-credential-stealing-surveillance-tool-ccannwumi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Fake CCleaner downloads turn Chrome into a credential-stealing surveillance tool | daily.dev og:description: A convincing fake CCleaner download site distributes a multi-stage Windows malware that ultimately hijacks Google Chrome via a malicious extension called... og:url: https://daily.dev/posts/fake-ccleaner-downloads-turn-chrome-into-a-credential-stealing-surveillance-tool-ccannwumi og:image: https://api.daily.dev/og/posts/ccANnWUmI.png og:image:alt: Fake CCleaner downloads turn Chrome into a credential-stealing surveillance tool og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Fake CCleaner downloads turn Chrome into a credential-stealing surveillance tool **[CSO Online](https://daily.dev/sources/csoonline)** · 3 min read · 0 upvotes · 0 comments ## Summary A convincing fake CCleaner download site distributes a multi-stage Windows malware that ultimately hijacks Google Chrome via a malicious extension called GhostDesk. Discovered by Malwarebytes researcher Sav Wheeler, the attack uses cscript.exe to run reconnaissance scripts, replace runtimebroker.dll with a reflexive loader, and modify Chrome's Security Extension manifest to inject background.js and content.js. These scripts capture keystrokes, credentials, cookies, screenshots, and clipboard cryptocurrency addresses, and maintain persistence via a WebSocket relay to a C2 server. The same infrastructure and CScript loading technique were found powering fake 7-zip and Adobe Acrobat installers, indicating a broader campaign. Malwarebytes recommends verifying download sources, being wary of sponsored search results, and using updated anti-malware with web protection. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the GhostDesk malware and how does it compromise Chrome? GhostDesk is a malicious Chrome extension delivered by a fake CCleaner installer that modifies Chrome's Security Extension manifest to inject two scripts, background.js and content.js. Content.js records keystrokes, scans forms for credentials and financial data, and swaps cryptocurrency addresses on clipboard paste, while background.js steals cookies, captures screenshots, executes arbitrary JavaScript, and maintains persistence via a WebSocket relay. _Security teams tracking browser-hijacking malware like GhostDesk can follow emerging threat research on daily.dev._ ### How is the fake CCleaner malware campaign being distributed and what other software is affected? Attackers set up a lookalike site at ccleanerwind[.]top where both download buttons deliver the same malicious CCleaner.exe, which drops a legitimate CScript instance to launch further malicious scripts. The same campaign infrastructure, including a command-and-control server at liderongrade.duckdns[.]org, was also found behind fake 7-zip and Adobe Acrobat installers, with some Adobe samples using wscript.exe instead of cscript.exe. _Developers evaluating software supply chain risks can track fake-installer campaigns like this one on daily.dev._ ## Similar posts on daily.dev - [The Chrome Extension Backdoor: How ‘Productivity Tools’ Became Enterprise Attack Vectors](https://daily.dev/posts/the-chrome-extension-backdoor-how-productivity-tools-became-enterprise-attack-vectors-y6ejg9d1h) · Security Boulevard · 0 upvotes · 0 comments - [Counterfeit installers turn routine software downloads into enterprise breaches](https://daily.dev/posts/counterfeit-installers-turn-routine-software-downloads-into-enterprise-breaches-mezthho2a) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#malware](https://daily.dev/tags/malware), [#google-chrome](https://daily.dev/tags/google-chrome) [View this post on daily.dev](https://daily.dev/posts/fake-ccleaner-downloads-turn-chrome-into-a-credential-stealing-surveillance-tool-ccannwumi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Fake CCleaner downloads turn Chrome into a credential-stealing surveillance tool","url":"https://daily.dev/posts/fake-ccleaner-downloads-turn-chrome-into-a-credential-stealing-surveillance-tool-ccannwumi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fake-ccleaner-downloads-turn-chrome-into-a-credential-stealing-surveillance-tool-ccannwumi"},"datePublished":"2026-08-12T11:27:52.408Z","dateModified":"2026-09-13T20:08:47.201Z","description":"A convincing fake CCleaner download site distributes a multi-stage Windows malware that ultimately hijacks Google Chrome via a malicious extension called...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9dc7dc1f7f10fa4d9baf6f000c7ace48?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9dc7dc1f7f10fa4d9baf6f000c7ace48?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fake-ccleaner-downloads-turn-chrome-into-a-credential-stealing-surveillance-tool-ccannwumi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,malware,google-chrome","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Fake CCleaner downloads turn Chrome into a credential-stealing surveillance tool"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/fake-ccleaner-downloads-turn-chrome-into-a-credential-stealing-surveillance-tool-ccannwumi#faq","mainEntity":[{"@type":"Question","name":"What is the GhostDesk malware and how does it compromise Chrome?","acceptedAnswer":{"@type":"Answer","text":"GhostDesk is a malicious Chrome extension delivered by a fake CCleaner installer that modifies Chrome's Security Extension manifest to inject two scripts, background.js and content.js. Content.js records keystrokes, scans forms for credentials and financial data, and swaps cryptocurrency addresses on clipboard paste, while background.js steals cookies, captures screenshots, executes arbitrary JavaScript, and maintains persistence via a WebSocket relay. Security teams tracking browser-hijacking malware like GhostDesk can follow emerging threat research on daily.dev."}},{"@type":"Question","name":"How is the fake CCleaner malware campaign being distributed and what other software is affected?","acceptedAnswer":{"@type":"Answer","text":"Attackers set up a lookalike site at ccleanerwind[.]top where both download buttons deliver the same malicious CCleaner.exe, which drops a legitimate CScript instance to launch further malicious scripts. The same campaign infrastructure, including a command-and-control server at liderongrade.duckdns[.]org, was also found behind fake 7-zip and Adobe Acrobat installers, with some Adobe samples using wscript.exe instead of cscript.exe. Developers evaluating software supply chain risks can track fake-installer campaigns like this one on daily.dev."}}]} ```