Malwarebytes has flagged a campaign that uses a lookalike CCleaner download site to deliver multi-stage Windows malware, ending with a malicious Chrome extension that steals credentials and spies on browsing.
Researcher Sav Wheeler documented the operation, which distributes a bogus CCleaner.exe from the impersonated domain ccleanerwind.top. Both the regular and “Cleaner Pro” download buttons serve the same file. The executable launches a legitimate copy of CScript, then uses it to run a chain of malicious scripts.
The scripts fingerprint the machine first. What follows is aimed straight at Chrome: the runtimebroker.dll copy inside AppData gets swapped for a reflective loader, and the browser’s Security Extension manifest is edited. Those edits allow background.js and content.js to run as a malicious extension at every Chrome startup. The name assigned by Malwarebytes for this payload is GhostDesk.
Content.js logs keystrokes and scans submitted forms for credentials, authentication tokens, and financial information. Background.js steals cookies, captures screenshots, runs arbitrary JavaScript, and swaps cryptocurrency addresses when victims paste them into websites. Persistence rides a WebSocket relay that reconnects when Chrome starts.
The operation reaches beyond one fake utility. The same CScript loading trick and the same C2 domain, liderongrade.duckdns.org, show up in fake 7-zip and Adobe Acrobat samples. Some Adobe builds swap in wscript.exe instead.
Stolen cookies and session tokens can bypass MFA and open the door to account takeover, which makes this a real enterprise concern. Malwarebytes advises checking web addresses carefully before downloading software, treating download links shared through social media, SMS, and email with suspicion, and verifying against the publisher’s official site. Up-to-date anti-malware with web protection blocks the fake landing page and detects the installer as Trojan.Dropper.
