Fake CCleaner downloads turn Chrome into a credential-stealing surveillance tool
Summary
A malicious campaign is distributing a fake CCleaner utility that installs a multi-stage Windows malware. This malware includes a malicious Chrome extension named GhostDesk, capable of stealing credentials, cookies, keystrokes, and screenshots.
IFF Assessment
FOE
This article details a new malware campaign that abuses a popular legitimate tool's name and a malicious Chrome extension to steal sensitive user data, posing a direct threat to defenders.
Defender Context
Defenders should be aware of campaigns impersonating legitimate software downloads to distribute malware. Users are at risk from fake CCleaner, 7-zip, and Adobe Acrobat installers that can lead to credential theft and surveillance via malicious browser extensions.