A spoofed CCleaner download site is spreading a multi-stage malware that hijacks Chrome to steal credentials, cookies and authentication tokens while recording keystrokes and screenshots.
A convincing fake version of the widely used CCleaner utility is being used to deliver a multi-stage Windows malware that ultimately abuses Google Chrome for credential theft and surveillance.
Researchers from Malwarebytes found the campaign distributing a malicious Chrome extension called GhostDesk, which can capture credentials, cookies, keystrokes, and screenshots while also allowing attackers to inject arbitrary JavaScript into active browser tabs.
Attackers created a lookalike CCleaner download site and used it to distribute a malicious “CCleaner.exe,” researcher Sav Wheeler said in a blog post.
Alongside GhostDesk, the researchers also identified fake 7-zip and Adobe Acrobat applications using the same techniques and command-and-control (C2) infrastructure.
CCleaner is a popular Windows PC cleaner utility, with more than 2 billion downloads worldwide. Wheeler said “the executable (fake CCleaner) initially drops a legitimate instance of CScript, then uses it to launch a series of (malicious) scripts.”
A fake cleaner with a multi-stage payload
The attack begins when a victim downloads the fake CCleaner executable file from the impersonated site “ccleanerwind[.]top.” Malwarebytes found that both the site’s regular and “Cleaner Pro” download buttons delivered the same malicious file.
When executed, “cscript.exe” runs a series of scripts carrying out basic system reconnaissance like collecting the machine GUID, hostname, and supported languages. It then replaces “runtimebroker.dll” in the user’s AppData directory with a reflexive loader and modifies Chrome’s Security Extension manifest.
This modification allows the attacker to inject two JavaScript files, “background.js” and “content.js,” that run as a malicious extension whenever Chrome starts. The resulting malware Malwarebytes tracks as GhostDesk.
While content.js was seen recording keystrokes and scanning submitted forms for credentials, authentication tokens, and financial information, background.js provided cookie theft, screenshot capture, and arbitrary JavaScript execution.
content.js was also found capable of monitoring clipboard activity and replacing cryptocurrency addresses when victims paste them into websites.
background.js provides persistence as it communicates through a WebSocket relay and can re-establish that connection when Chrome starts, Wheeler pointed out.
The campaign is bigger than GhostDesk
The campaign’s impact was traced beyond users who specifically searched for CCleaner. Malwarebytes found fake 7-zip and Adobe Acrobat samples using the same CScript loading mechanism, with the samples communicating with the same C2 at “liderongrade.duckdns[.]org.”
The only difference observed was some Adobe samples using “wscript.exe” instead of cscript.exe, likely attackers attempting to adapt delivery to different software, Wheeler noted.
The combination of browser cookies, credentials, keystrokes and screen captures makes the compromise concerning for enterprises and worth setting protections against. Captured authentication tokens and financial information add further risk.
Malwarebytes recommended checking the web address carefully before downloading software, noting that sponsored search results can be abused by cybercriminals. It also advised treating software download links shared through social media, SMS and email with caution, and verifying downloads against trusted sources such as the publisher’s official website or app stores.
The company also recommended using an up-to-date, real-time anti-malware solution with web protection. The one from Malwarebytes blocks connections to unsafe sites such as the fake CCleaner landing page and detects the fake installer as “Trojan.Dropper,” it added.
Keeping the operating system, browser, and security software up to date remains a must.