Fake CCleaner Installer Deploys GhostDesk Chrome Spyware to Steal Credentials
What Happened — A counterfeit version of the popular PC‑cleaning tool CCleaner was hosted on a look‑alike website (ccleanerwind.top). When users downloaded and ran the fake CCleaner.exe, it dropped a CScript loader that patched Chrome’s security extension and installed a malicious Chrome extension named GhostDesk. The extension can capture keystrokes, take screenshots, and exfiltrate saved browser credentials to a command‑and‑control server.
Why It Matters for Compliance & Audit Readiness
- Demonstrates how social‑engineering‑driven malware can bypass traditional endpoint controls and harvest credentials, a scenario SOC 2 Access Controls (CC6.1, CC6.2) are designed to detect and log.
- Continuous evidence of credential‑use monitoring and browser‑extension governance is required to prove that access‑control policies are enforced and auditable.
- Security‑awareness training that covers fake‑software downloads is a key control to satisfy SOC 2 Security criteria and to reduce the likelihood of similar incidents.
Who Is Affected – All Windows‑based organizations that allow users to install third‑party utilities, especially those in Technology SaaS, Financial Services, and Healthcare where browser‑based credential use is common.
Recommended Actions
- Update endpoint protection to block execution of unsigned installers and to monitor for CScript activity.
- Enforce a policy that restricts Chrome extension installation to a whitelist of approved IDs; log all extension changes.
- Conduct a targeted security‑awareness session on fake‑software downloads and the risks of browser‑based spyware.
- Review SOC 2 access‑control evidence (audit logs, privileged‑access reviews) for any anomalous credential‑access patterns.
Source: Malwarebytes Labs – Fake CCleaner installs GhostDesk Chrome spyware
Technical Notes – The attack chain uses a malicious CCleaner.exe that drops cscript.exe, patches %AppData%\Microsoft\DriverStore\runtimebroker.dll, modifies Chrome’s manifest.json, and creates a local WebSocket that tunnels to liderongrade.duckdns.org:4444. The final payload consists of content.js and background.js delivering keylogging, screenshot capture, and credential harvesting. Source: Malwarebytes technical analysis