Fake CCleaner Installer Delivers GhostDesk Chrome Spyware with Keylogging, Credential Theft, and Crypto Clipboard Hijacking
Fake CCleaner Installer Delivers GhostDesk Chrome Spyware (TL-2026-1990), also tracked as GhostDesk Campaign, is a high-severity malware campaign, first published 2026-08-11. It has no confirmed attribution, affects Piriform / Gen Digital CCleaner (brand impersonated), maps to 13 MITRE ATT&CK techniques (T1012, T1036.005, T1056.001), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-1990
- Threat ID
- TL-2026-1990
- Also known as
- GhostDesk Campaign, Fake CCleaner Malvertising Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-11
- Last reviewed
- 2026-08-11
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- opportunistic consumer and general-enterprise endpoints not sector-targeted
- Target regions
- Unknown / Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Fake CCleaner Installer Delivers GhostDesk Chrome Spyware
Malware and tooling: GhostDesk, Trojan.Dropper, cscript.exe
A site impersonating the CCleaner download page (ccleanerwind.top) distributes a trojanized CCleaner.exe that deploys GhostDesk, a Chrome-extension spyware implant with keylogging, credential harvesting, cryptocurrency clipboard hijacking, cookie theft, screenshot capture, and arbitrary JavaScript injection. Related fake 7-Zip and Adobe Acrobat installers share the same liderongrade.duckdns.org C2 infrastructure, indicating a multi-lure campaign.
How Fake CCleaner Installer Delivers GhostDesk Chrome Spyware works
Malwarebytes Threat Intelligence documented a malvertising/fake-software campaign in which a convincing clone of the CCleaner download page, ccleanerwind.top, serves a trojanized CCleaner.exe (SHA256 c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23) detected as Trojan.Dropper. On execution, the installer drops the legitimate Windows CScript interpreter and uses it to run a series of staging scripts that perform system reconnaissance via registry queries, patch the Chrome Security Extension manifest, and write malicious extension files (content.js, background.js) to %LocalAppData%\cse. The dropper also replaces the Windows Runtime Broker with a reflexive (reflective) loader (runtimebroker.dll, SHA256 8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904) to maintain persistence.
Once loaded, the GhostDesk Chrome extension establishes a local WebSocket bridge (127.0.0.1:7345/ext) for native-messaging communication with the host-side implant and connects out to a command-and-control server at liderongrade.duckdns.org (193.169.240.81) on port 4444. GhostDesk is a full-featured browser spyware implant: it records keystrokes typed into input fields, intercepts POST requests for form-based credential harvesting, exfiltrates cookies via chrome.cookies.getAll for session hijacking, hijacks the clipboard to swap cryptocurrency wallet addresses on paste, captures active-tab screenshots via a captureTab function, and can inject and execute arbitrary JavaScript into web pages via chrome.scripting.executeScript.
Malwarebytes identified related trojanized installers impersonating 7-Zip (SHA256 590b04e35fc0b3dcd9dabe82f2e96d4d1e0fccc598911cf80f8255232ee75fcb) and Adobe Acrobat (three variants, including one delivered via a wscript-based loader) that all beacon to the same liderongrade.duckdns.org C2, confirming a coordinated multi-lure campaign rather than an isolated CCleaner-specific incident. The abuse of DuckDNS, a free dynamic-DNS provider, for the C2 hostname is a known pattern also flagged independently by Malwarebytes' own duckdns.org threat-detection page. No threat actor has been named or attributed by the source reporting; the combination of credential theft, session-cookie theft, and cryptocurrency clipboard hijacking is consistent with financially motivated cybercrime rather than espionage. A BeaconBeagle lookup for the C2 IP (193.169.240.81) and the C2 domain (liderongrade.duckdns.org) returned no existing correlation data at the time of this research, consistent with a newly reported campaign.
MITRE ATT&CK techniques used in TL-2026-1990
Discovery
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1620 Reflective Code Loading
Collection
T1056.001 Keylogging; T1113 Screen Capture
Execution
T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
Persistence
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Resource Development
Affected products and versions in Fake CCleaner Installer Delivers GhostDesk Chrome Spyware
- Piriform / Gen Digital — CCleaner (brand impersonated)
Vulnerable versions: N/A - not a vulnerability in genuine CCleaner; a look-alike trojanized installer is distributed from ccleanerwind.top
Fixed in: N/A - Igor Pavlov / 7-Zip — 7-Zip (brand impersonated)
Vulnerable versions: N/A - trojanized look-alike installer sharing the GhostDesk C2 infrastructure
Fixed in: N/A - Adobe — Adobe Acrobat (brand impersonated)
Vulnerable versions: N/A - multiple trojanized look-alike installer variants (including a wscript-based variant) sharing the GhostDesk C2 infrastructure
Fixed in: N/A - Google — Google Chrome (attack surface via manifest-patched malicious extension)
Vulnerable versions: Any version permitting local manifest patching / unmanaged extension sideloading
Fixed in: N/A - mitigated via Chrome extension management policy, not a Chrome vulnerability
Remediation for Fake CCleaner Installer Delivers GhostDesk Chrome Spyware
Immediate actions
- Block network indicators at DNS/firewall/proxy: domain ccleanerwind.top, domain liderongrade.duckdns.org, and IP 193.169.240.81.
- Hunt for and remove GhostDesk artifacts: the %LocalAppData%\cse directory, a patched Chrome Security Extension manifest, and a replaced runtimebroker.dll matching SHA256 8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904.
- On any host that downloaded from ccleanerwind.top (or the related fake 7-Zip/Adobe Acrobat sites), reset the Chrome profile, rotate credentials and invalidate session cookies used on that host, and check cryptocurrency wallet addresses recently pasted for tampering.
- Warn users that CCleaner, 7-Zip, and Adobe Acrobat must only be downloaded from their official vendor domains, never from search-ad or unfamiliar-domain links.
Workarounds
- Restrict cscript.exe/wscript.exe execution for standard users where feasible.
- Use DNS filtering to block resolution of dynamic-DNS providers such as duckdns.org for non-technical user segments.
Longer-term hardening
- Deploy application allowlisting / LOLBin monitoring for cscript.exe launching scripts from user download or temp directories.
- Enforce a Chrome extension management policy (ExtensionInstallBlocklist/Allowlist) to prevent unmanaged or sideloaded extensions.
- Deploy EDR with behavioral detection for browser-extension persistence, Chrome manifest tampering, and reflective code/DLL loading.
- Monitor for outbound WebSocket/application-layer connections to dynamic-DNS domains (e.g., *.duckdns.org) as a C2 detection signal.
Timeline of Fake CCleaner Installer Delivers GhostDesk Chrome Spyware
- Malwarebytes Threat Intelligence publishes the GhostDesk research, detecting the fake CCleaner installer as Trojan.Dropper.
- Malwarebytes identifies related trojanized installers impersonating 7-Zip and Adobe Acrobat that share the same liderongrade.duckdns.org C2 infrastructure, indicating a multi-lure campaign.
- GhostDesk begins keylogging, form-based credential harvesting, cookie theft via chrome.cookies.getAll, cryptocurrency clipboard hijacking, and on-demand screenshot capture via captureTab, exfiltrating data to the C2 server.
- GhostDesk opens a local WebSocket bridge (127.0.0.1:7345/ext) and connects out to the C2 server at liderongrade.duckdns.org (193.169.240.81) on port 4444.
- The Windows Runtime Broker is replaced with a reflexive loader (runtimebroker.dll) to maintain persistence and reload GhostDesk components.
- Malicious GhostDesk extension files (content.js, background.js) are written to %LocalAppData%\cse and the Chrome Security Extension manifest is patched to load them.
- Staging scripts perform system reconnaissance via registry queries before deploying the payload.
- Victim downloads and runs the fake CCleaner.exe (detected as Trojan.Dropper), which drops the legitimate Windows CScript interpreter to execute staging scripts.
- Fake CCleaner download site ccleanerwind.top identified distributing a trojanized CCleaner.exe, as documented by Malwarebytes Threat Intelligence.
Sources cited for Fake CCleaner Installer Delivers GhostDesk Chrome Spyware
Threats related to Fake CCleaner Installer Delivers GhostDesk Chrome Spyware
Detection coverage for TL-2026-1990
As of 2026-08-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1990 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1990
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.