Fake CCleaner Installers Deliver GhostDesk Chrome Spyware

Summary

A technical investigation found fake CCleaner and other installers using a CScript-based chain to modify Chrome and install GhostDesk, which can capture keystrokes, form data, cookies, and screenshots.

Key points

A counterfeit CCleaner download site, ccleanerwind[.]top, served an installer disguised with the legitimate app’s name and icon.
The installer used CScript to run a multi-stage chain involving system reconnaissance, a reflexive loader, and changes to Chrome’s Security Extension.
GhostDesk’s content script can log keystrokes, intercept form submissions, alter cryptocurrency-related clipboard pastes, and inject scripts into selected pages.
Its background script can collect browser cookies, capture the active tab, and execute JavaScript; WebSocket connections support communication and data transfer.
The campaign’s C2 infrastructure included liderongrade.duckdns[.]org, and researchers found fake 7-Zip and Adobe Acrobat installers using the same chain.
The article recommends checking software download addresses, using trusted download sources, and keeping operating systems, browsers, and security software updated.

Article Details

Attack Vectors: A counterfeit CCleaner download site distributes a malicious Windows installer using the CCleaner name, icon, and filename.
The installer uses CScript to run a multi-stage infection chain, gather system information, replace runtimebroker.dll with a reflexive loader, and modify Chrome’s Security Extension to load GhostDesk JavaScript components.
Fake 7-Zip and Adobe Acrobat installers use the same delivery approach and C2 infrastructure; one additional Adobe Acrobat sample uses wscript.exe instead of cscript.exe.
GhostDesk captures keystrokes, submitted form data and cookies, takes screenshots, and can execute arbitrary JavaScript in the active browser tab. It also alters certain pasted cryptocurrency strings.
The malware communicates with its C2 server over WebSockets and uses a local WebSocket relay to exchange data and commands.
Defensive Notes: Check download addresses carefully and obtain software from the publisher’s official website or trusted app stores; professional-looking pages and sponsored search results are not proof of legitimacy.
Treat software download links received through social media, SMS, or email with caution.
Use up-to-date real-time anti-malware with web protection, and keep the operating system, browser, and security software updated.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`ccleanerwind[.]top`	Counterfeit CCleaner download domain identified as distributing the malicious installer.
DOMAIN	`liderongrade[.]duckdns[.]org`	C2 domain used by the malware and the related fake-app samples.
IPV4	`193[.]169[.]240[.]81`	IP address identified as a command-and-control server.
SHA256	`0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56`	SHA-256 hash of an additional fake Adobe Acrobat sample that uses wscript.exe.
SHA256	`3d7411e2e445a2210dbbf061f3e8e3dd3476a4fc5d4a2135dcceb0bc705776bf`	SHA-256 hash of the malicious GhostDesk content.js extension component.
SHA256	`590b04e35fc0b3dcd9dabe82f2e96d4d1e0fccc598911cf80f8255232ee75fcb`	SHA-256 hash of a fake 7-Zip sample using the same infection chain.
SHA256	`8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904`	SHA-256 hash of the reflexive loader that replaces runtimebroker.dll.
SHA256	`c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23`	SHA-256 hash of the fake CCleaner.exe installer.
SHA256	`cfa3900cefb447d89a7498224f2ecafa65b190336934811e6c1d4196d9b92452`	SHA-256 hash of another fake Adobe Acrobat sample in the campaign.
SHA256	`cfd9c0bcc89ebc68aae889b9b49bc8290c3764bce5f2c9ac8b5ba0ba58e9bf61`	SHA-256 hash of the malicious GhostDesk background.js extension component.
SHA256	`ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d`	SHA-256 hash of a fake Adobe Acrobat sample using the same infection chain.