Someone in your organization searching for CCleaner can land on ccleanerwind[.]top, a lookalike download site, and walk away with a trojan dropper instead of the utility they wanted. Malwarebytes researcher Sav Wheeler documented the campaign, and both download buttons on the fake page, the standard one and the "Cleaner Pro" option, serve the same malicious CCleaner.exe. Details in this article come from analysis published by CSO Online.

CCleaner works as a lure because it is genuinely common. The real utility has passed more than 2 billion downloads worldwide, so a request to install it rarely raises eyebrows with a help desk or a user.

The executable does not carry the payload openly. It drops a legitimate copy of Windows Script Host and uses cscript.exe to run a chain of scripts, which is why the initial activity looks like ordinary signed Microsoft tooling rather than malware. Those scripts collect basic host details, including the machine GUID, hostname, and supported languages, then replace runtimebroker.dll in the user's AppData directory with a reflective loader and edit Chrome's extension manifest.

That manifest edit is where the browser becomes the attacker's tool. Two injected JavaScript files, background.js and content.js, load as an extension every time Chrome starts. Malwarebytes tracks the result as GhostDesk, and it records keystrokes, scrapes submitted forms for credentials, authentication tokens, and financial data, steals cookies, captures screenshots, and runs arbitrary JavaScript inside active tabs.

The practical consequence for your firm is that session cookies and tokens taken from a browser let an attacker reach cloud email, finance portals, and SaaS accounts without ever needing a password or tripping an MFA prompt. Keystroke and screenshot capture on the same host gives them context for what those accounts control.

The reach extends past CCleaner searchers. The same researchers found fake 7-zip and Adobe Acrobat installers using the identical script-loading method, some substituting wscript.exe, all reporting to the C2 at liderongrade.duckdns[.]org.

Attack Chain: From Download to Chrome Hijacking

The dropper does not do the heavy lifting itself. It writes a legitimate copy of Microsoft's Windows Script Host binary to disk and then uses that signed interpreter, cscript.exe, to run a chain of malicious scripts. That pattern maps to MITRE ATT&CK T1059.005 (Command and Scripting Interpreter: Visual Basic) combined with execution through a trusted, signed Microsoft binary, which is why process-lineage alerts matter more here than file reputation.

The first scripts perform basic host profiling: machine GUID, hostname, and the system's supported languages (T1082, System Information Discovery). Attackers use that fingerprint to separate real corporate endpoints from sandboxes and to decide which victims are worth further attention.

Next comes the loader stage. The scripts replace runtimebroker.dll inside the user's AppData directory with a reflective loader, a DLL that maps code into memory instead of dropping additional executables that a scanner would inspect on disk. The filename choice is deliberate, since a real RuntimeBroker process is a normal part of Windows, so the name blends into a process list and into an analyst's quick review of running tasks. In practice this means the payload lives in a per-user path that requires no administrative rights to write.

With the loader in place, the malware modifies Chrome's Security Extension manifest so that two attacker-supplied JavaScript files load as an extension every time the browser starts. This is T1176, Browser Extensions, and it is the pivot point of the whole campaign: from here, the malware operates inside the browser's own trust boundary, where session cookies are already decrypted and form data is already in plaintext.

The two files split responsibilities:

• content.js runs in the page context. It records keystrokes and scans submitted forms for credentials, authentication tokens, and financial information (T1056.001, Keylogging).
• content.js also monitors clipboard activity (T1115) and replaces cryptocurrency addresses when a victim pastes them into a website, redirecting transfers to attacker-controlled wallets.
• background.js handles cookie theft (T1539, Steal Web Session Cookie), screenshot capture (T1113), and arbitrary JavaScript execution in active tabs, which gives the operator interactive control of authenticated sessions.

Stolen session cookies are the part that hurts an enterprise most, because a valid cookie replays an already-authenticated session and bypasses the MFA prompt the user completed earlier. Password resets alone do not close that door.

Persistence sits in background.js, which communicates over a WebSocket relay and re-establishes that connection whenever Chrome launches (T1071.001, Application Layer Protocol: Web Protocols). Because the channel opens from inside a browser process making outbound web-protocol traffic, it looks unremarkable in flow data.

For infrastructure tracing, the campaign extends past the one lure. Malwarebytes identified fake 7-zip and Adobe Acrobat samples using the same script-loading mechanism, all beaconing to a shared C2:

• C2 endpoint: liderongrade.duckdns[.]org
• Loader artifact: runtimebroker.dll written under the user's AppData path
• Execution variant: some Adobe Acrobat samples call wscript.exe instead of cscript.exe, an adaptation of the delivery chain to different software
• Detection name for the installer: Trojan.Dropper

No file hashes were published with the research, so hunting in your environment leans on the dynamic DNS C2 domain, the script-host process lineage, and the Chrome extension manifest change rather than on static signatures.

Business and Compliance Impact of GhostDesk Infections

Stolen session cookies are the part of a GhostDesk infection that changes your risk calculus. A cookie captured by background.js represents an already-authenticated session, so an attacker who imports it into their own browser reaches your Microsoft 365 tenant, CRM, or payroll portal without needing the password and without triggering an MFA prompt.

Chrome is where most of your staff keep working credentials, and the extension reads what the browser sees. Per Malwarebytes, content.js records keystrokes and scans submitted forms for credentials, authentication tokens, and financial information as they are typed.

That means a single infected employee endpoint puts a predictable set of assets in play:

• Saved passwords and autofilled logins for every SaaS application that person uses
• Live authentication tokens for services protected by single sign-on
• Payment card and banking details entered into web forms
• Screenshots of whatever was on screen, which can include client records, contracts, and internal dashboards
• Clipboard contents, including cryptocurrency wallet addresses that the malware can silently replace with the attacker's own

The clipboard substitution deserves separate attention if your finance team handles crypto payments. A payment that looks correct when copied leaves with a different destination address, and that transfer is not reversible. Your accounts team discovers the loss at reconciliation, not at the moment of the transaction.

The arbitrary JavaScript injection capability is the piece compliance officers should understand. An attacker who can run code inside an active tab can alter what a logged-in user sees and does in your business applications, which complicates any later attempt to prove which actions in an audit log were genuinely taken by that employee.

Breach notification obligations turn on unauthorized access to personal data, not on whether files were encrypted or exfiltrated in bulk. If an infected browser session touched customer records, your GDPR assessment starts with a 72-hour reporting clock to the relevant supervisory authority once you become aware. Under CCPA, exposure of credentials tied to California residents' accounts carries its own notification duties and statutory damages exposure.

Regulated sectors carry more. Financial services firms face similar questions from examiners about customer account data and transaction detail.

Remediation is rarely limited to reimaging the affected machine. Because the extension harvested live tokens, your response has to assume every credential that user held is compromised, which means forced password resets, session revocation across federated applications, and review of authentication logs for the period the infection was active. Investigators also have to determine how long the WebSocket relay was reachable in order to scope the exposure window, and that scoping work is usually where outside forensic costs accumulate.

Scope your assumptions beyond CCleaner. Malwarebytes found fake 7-zip and Adobe Acrobat installers using the same delivery mechanism and reporting to the same command-and-control host at liderongrade.duckdns[.]org, so an inventory of what your users have downloaded matters as much as the single application name in the headline.

Customers and clients tend to judge these incidents by what you can tell them. A firm that cannot state which accounts were accessed, or over what period, ends up notifying more people than the incident may have warranted.

Detection and Immediate Response for GhostDesk

Start by pulling the suspected host off the network and treating the browser profile as compromised, because the extension re-establishes its WebSocket connection every time Chrome launches. Killing the browser process does not remove it. You need to remove the injected extension files and the loader in %APPDATA% before the machine goes back into service.

In the first 24 hours, work through the on-disk Chrome artifacts on every affected endpoint:

• Enumerate installed extensions per profile: dir /s /b "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions". Read Local State first to get the full profile list, since staff with multiple Chrome profiles will have artifacts outside Default.
• Open Preferences and Secure Preferences and look for extension entries whose install path sits outside the Extensions directory or that lack a Web Store install source. GhostDesk arrives by modifying the extension manifest, so the loaded extension will not match a Chrome Web Store ID.
• Hunt for the loader: Get-ChildItem $env:APPDATA -Recurse -Filter runtimebroker.dll -ErrorAction SilentlyContinue, then compare the hash against the legitimate Windows binary rather than trusting the filename.
• Grep the extension directories and profile folders for background.js and content.js files with recent write times that no Web Store extension accounts for.

Query your DNS and proxy logs for liderongrade.duckdns[.]org across the full retention window, not just the last few days. Because the fake 7-Zip and Adobe Acrobat installers use the same C2, a hit tells you the campaign reached your environment even if nobody searched for a PC cleaner.

Two detection rules pay for themselves here. Alert when cscript.exe or wscript.exe executes with a script argument from a user-writable path such as Downloads, Temp, or AppData, and alert when any process other than chrome.exe or the Chrome updater writes to Preferences or Secure Preferences. That second rule catches the manifest tampering step directly and generates very little noise in a normal estate.

Over the following week, treat the identity side as the real cleanup. Rotate every credential saved in the browser's Login Data store, then revoke active sessions rather than stopping at password resets, since a captured cookie stays valid until the session is invalidated. In Microsoft 365 that means Revoke-MgUserSignInSession for each affected account, plus a review of newly granted OAuth application consents, mailbox forwarding rules, and MFA device registrations added during the exposure window.

In environments Capstone manages, Adlumin flags the authentication anomalies that follow a cookie replay, including sign-ins from unfamiliar sources against accounts that never prompted for MFA. That is the signal you get when the stolen session, rather than the stolen password, is being used.

For the one to four week window, put controls in place that stop the next installer:

• Set Chrome enterprise policy to blocklist all extensions with an explicit allowlist, and enable BlockExternalExtensions so side-loaded extensions cannot register.
• Block execution of cscript.exe and wscript.exe from user-writable directories through AppLocker or WDAC, and require signed installers for common utilities.
• Sinkhole dynamic DNS providers such as duckdns.org at the resolver, and block newly registered lookalike download domains at the web gateway.
• Publish an internal software source list so staff install utilities from your package manager or the publisher's site instead of sponsored search results.

Document which accounts had sessions revoked and which endpoints were reimaged. If clipboard hijacking touched finance workflows, confirm any cryptocurrency or wire destination addresses used during the exposure period against out-of-band records.

Preventing GhostDesk Infections: Distribution and Software Validation

The most effective control here is removing the user's ability to run an unsigned installer from a download folder at all. Application allowlisting through Windows Defender Application Control or AppLocker stops the fake CCleaner.exe at execution, before any scripts touch the browser profile. If a full allowlist is too disruptive to roll out, start with a publisher rule set that permits signed installers and denies unsigned binaries running from %USERPROFILE%\Downloads and %TEMP%.

Pair that with a short, enforced list of where software may come from. Your standard should be the publisher's own website or the Microsoft Store, and nothing else. Malwarebytes specifically flagged sponsored search results as an abused delivery path, which means the top result your staff click is not a trustworthy indicator of legitimacy.

On the network side, apply blocks at the DNS and egress layers:

• Sinkhole the impersonated download domain and any newly registered typosquats of common utility names in your DNS filtering policy.
• Block or alert on outbound traffic to dynamic DNS providers, including *.duckdns.org, since the campaign's command-and-control host sits on that service. Few business applications need dynamic DNS resolution, so the false-positive cost is low.
• Restrict WebSocket connections from browsers to unapproved external hosts where your proxy supports it, since that is the channel the extension uses to stay reachable.

The same loader mechanism was found behind counterfeit 7-zip and Adobe Acrobat packages, so scoping your controls to CCleaner alone leaves the door open. Treat free utilities as a category: PDF tools, archivers, cleaners, and codec packs are the software classes attackers repackage most often, because staff install them without a purchase approval or a ticket.

Teach signature verification as a two-step habit rather than a technical exercise. Users can right-click an installer, open Properties > Digital Signatures, and confirm the publisher name matches the vendor they intended to download from. Where a vendor publishes a SHA-256 hash, your help desk can validate it with Get-FileHash installer.exe -Algorithm SHA256 before deployment. A missing or mismatched signature is enough reason to stop, and your policy should say so explicitly.

The behavior worth planning around is the user who goes looking for a cracked or bundled build because the licensed version was not available to them. That is a supply problem more than a discipline problem. Publish a self-service catalog through your management platform with vetted, current versions of the utilities people actually ask for, then remove local administrator rights so an off-catalog installer cannot write a loader into the user profile or alter browser extension files in the first place.

SentinelOne detects and blocks dropper-class installers of this type on execution across managed environments, including the script-host chain the fake utility uses to stage its payload. That gives you enforcement on the endpoint even when a user reaches the malicious page from a sponsored ad your DNS filter has not yet categorized.

Finally, set Chrome extension policy centrally through Chrome Enterprise. Configure ExtensionInstallBlocklist to * and allowlist only the extension IDs your business requires, and disable developer mode for managed profiles. Manifest tampering on an already-installed extension can work around ID-based rules, which is why allowlisting extensions supports the endpoint controls above and does not replace them. Keep browser and operating system updates on a short cycle so the browser is patched against whatever the next loader targets.

What to Do First If GhostDesk Is Detected

The one sequencing decision that matters most is that isolation comes before any password reset. GhostDesk records keystrokes and reads form submissions in the browser, so if you reset an administrator password while the infected host still has network access, you hand the attacker the new credential as it is typed.

Pull the machine off the network first, including Wi-Fi and any cellular dongle, then perform every reset from a different, known-clean device.

Treat the affected endpoint as an evidence source before you clean it. Take a disk image or at minimum copy off the Chrome profile directory, the browser cache, the extensions folder, and the user registry hive while they are intact. Once you reimage, you lose the ability to answer which accounts were actually touched, and that question drives your breach notification analysis.

The most important follow-up action is to assume every credential used on that machine is compromised and reset accordingly. Work in priority order: email accounts first, since they control password recovery for everything else, then banking and payment portals, then any domain or cloud administrative account the user held.

Password changes alone are not enough on their own. Revoke active sessions and refresh tokens for each account, because an authenticated session captured earlier stays valid until the identity provider invalidates it.

One detail worth checking in your review: the extension monitors clipboard activity and substitutes cryptocurrency addresses on paste. If the user initiated any crypto transfer or copied payment details from that host, verify the destination addresses against your own records before assuming the funds went where intended.