Fake CCleaner Downloads: Chrome Credential Theft Threatens Enterprises

The Hidden Danger in Popular PC Cleaning Utilities

A convincing fake version of the widely used CCleaner utility is being used to deliver a multi-stage Windows malware that abuses Google Chrome for credential theft and surveillance. African enterprises must remain vigilant, as these supply-chain attacks target the very tools employees trust daily.

How the Attack Works

Researchers from Malwarebytes found the campaign distributing a malicious Chrome extension called GhostDesk, which can capture credentials, cookies, keystrokes, and screenshots while also allowing attackers to inject arbitrary JavaScript into active browser tabs.

Fake download sites: Attackers created a lookalike CCleaner download site at ccleanerwind[.]top, distributing a malicious “CCleaner.exe” file that delivers the full payload. Multi-stage delivery: The fake executable initially drops a legitimate instance of cscript.exe, then uses it to launch a series of malicious scripts for system reconnaissance. AppData persistence: The attack replaces runtimebroker.dll in the user’s AppData directory with a reflexive loader, ensuring long-term persistence on the infected machine. Chrome extension abuse: Modified Chrome Security Extension manifest allows injection of two JavaScript files—background.js and content.js—that run as a malicious extension whenever Chrome starts.

GhostDesk: The Malware Behind the Attack

The resulting malware, tracked as GhostDesk, performs the following malicious activities: content.js records keystrokes, scans submitted forms for credentials and authentication tokens, captures financial information, and monitors clipboard activity to replace cryptocurrency addresses when victims paste them into websites. background.js provides cookie theft, screenshot capture, and arbitrary JavaScript execution. It also communicates through a WebSocket relay and can re-establish that connection when Chrome starts.

Broader Campaign Impact

The campaign extends beyond CCleaner downloads. Malwarebytes identified fake 7-zip and Adobe Acrobat applications using the same CScript loading mechanism, with the samples communicating with the same C2 at liderongrade.duckdns.org. This indicates a coordinated supply-chain attack affecting multiple popular utility categories.

Enterprise Risk and Recommendations

The combination of browser cookies, credentials, keystroke logging, and screen captures makes this compromise particularly concerning for enterprises. Captured authentication tokens and financial information add further risk, potentially leading to lateral movement within corporate networks. Check web addresses carefully before downloading software, noting that sponsored search results can be abused by cybercriminals. Treat software download links shared through social media, SMS, and email with caution; verify downloads against trusted sources such as the publisher’s official website or app stores. Use an up-to-date anti-malware solution with web protection. Solutions such as Malwarebytes block connections to unsafe sites such as the fake CCleaner landing page and detect the fake installer as Trojan.Dropper. Keep the operating system, browser, and security software up to date.

Conclusion

Supply-chain attacks targeting legitimate software utilities represent an emerging threat vector for enterprises across Africa. The fake CCleaner campaign demonstrates how attackers exploit trusted names to deliver credential-stealing malware that compromises browser security. Organizations must adopt a defense in depth approach, combining user education, strict download policies, and threat protection to mitigate these risks.

—

eHawu Security Intelligence — Our network-layer security solutions provide enterprise-grade protection against malicious downloads and command-and-control communications. By monitoring DNS traffic and blocking known threat infrastructures at the network boundary, eHawu prevents compromised endpoints from exfiltrating credentials and establishing persistent connections. Organizations should integrate network monitoring with endpoint security to disrupt multi-stage attack chains at their earliest stages.