Fake CCleaner Installer Delivers GhostDesk Chrome Spyware
A malicious campaign impersonating the popular CCleaner utility is distributing the GhostDesk spyware, which targets Chrome users with credential theft, keylogging, and screen capture capabilities.
Cybercriminals are leveraging the widespread trust in the CCleaner utility to distribute a sophisticated spyware payload known as GhostDesk. Attackers have created a convincing fake website that mimics the official CCleaner download page, tricking unsuspecting users into downloading a malicious executable disguised as the legitimate PC cleaning tool. This fake installer, while appearing to be CCleaner, contains altered version information and uses internal filenames that do not align with legitimate CCleaner releases, signaling its malicious intent.
The infection chain begins with the execution of the fake CCleaner.exe, which then utilizes the legitimate Windows cscript.exe to launch a series of scripts. These scripts perform initial system reconnaissance, gathering information such as machine GUID, name, and supported languages. Crucially, they also inject a malicious DLL into the legitimate Runtime Broker process and proceed to patch Chrome's Security Extension (CSE) by modifying its manifest.json file. This modification allows for the silent installation of malicious JavaScript files, background.js and content.js, into the Chrome user profile directory.
Following the initial setup, the malware establishes a command-and-control (C2) channel. It creates a local WebSocket endpoint and then upgrades this connection to communicate with a remote server hosted on liderongrade.duckdns.org:4444. This persistent connection allows attackers to send commands and receive data from the compromised browser.
The core of the spyware functionality resides within the two injected JavaScript files, content.js and background.js. These scripts work in tandem, enabling a range of malicious activities. content.js is responsible for keylogging user input within browser fields and harvesting credentials from submitted forms, particularly those containing keywords related to authentication or financial information. It also monitors clipboard activity for cryptocurrency strings, replacing them with attacker-controlled values, and injects scripts into specific web pages.
Meanwhile, background.js manages the exfiltration of stolen data and executes commands received from the C2 server. It opens a local WebSocket relay on 127.0.0.1:7345/ext for secure communication. This script is also capable of stealing browser cookies, capturing screenshots of the active tab, and executing arbitrary JavaScript code within the browser context, effectively granting attackers significant control over the user's browsing session.
The spyware is named GhostDesk, a name also associated with legitimate overlay software used for AI agent screen interaction. This naming choice may serve as a rudimentary attempt to camouflage the screen-capture capabilities of the malware. The combined functionalities of keylogging, credential harvesting, cookie theft, and screen capture make GhostDesk a potent tool for espionage and financial fraud.
This campaign highlights a common tactic where attackers exploit the reputation of trusted software to distribute malware. Users are advised to exercise extreme caution when downloading software, always verifying the authenticity of download websites and being wary of sponsored search results or links from untrusted sources. Ensuring that browser extensions are legitimate and from trusted developers is also a critical defense against such threats.