Windows users searching for a trusted cleanup tool are being misled by a deceptive download site. This fraudulent page offers a file that installs GhostDesk, a harmful Chrome extension designed to monitor browser activities.
Malicious Campaign Targets Windows Users
This scheme transforms a routine software download into a threat for credential theft, keystroke logging, screenshot capturing, cookie collection, and browser tab manipulation. The campaign’s use of a recognizable application name highlights the danger of assuming a download is safe based on appearance alone.
Technical Details of GhostDesk Installation
Malwarebytes has revealed in a report shared with Cyber Security News (CSN) that the operation starts with a counterfeit CCleaner website, leading to a multi-step infection process on Windows. The false site, ccleanerwind[.]top, offers downloads that both lead to the same malicious executable.
Once installed, the fake CCleaner uses a misleading name and icon. It deploys the Windows Script Host’s CScript component, collects basic device information, and replaces a Runtime Broker library with a loader for further infection stages. This alteration affects Chrome’s Security Extension settings, forcing two scripts, content.js and background.js, to load locally when the browser is launched.
Security Implications and User Protection
The GhostDesk extension is adept at recording form entries and searching for credentials, authentication tokens, and financial information. It can also alter pasted cryptocurrency addresses, potentially redirecting payments without the user’s knowledge.
This background component can gather browser cookies, access active tabs, maintain a local relay, and inject attacker-supplied JavaScript into open pages. Such extensive permissions underscore the importance of reviewing browser extension permissions, especially on devices handling sensitive information.
Security experts traced this loading method to similar fake applications, including 7-Zip and Adobe Acrobat, all communicating with the same command-and-control domain. Users who downloaded the fake installer should immediately disconnect from sensitive accounts, run a security scan, and remove unfamiliar Chrome extensions.
To protect yourself, ensure software is downloaded from official publisher sites or trusted stores. Keep your systems updated and regularly review browser extensions. The recent case of the fake GoogleTranslate extension serves as a reminder of the risks associated with familiar names hiding malicious tools.
