Reported by 2 outlets

Timeline

1. original reporting

   Fake CCleaner Installer Deploys GhostDesk Chrome Spyware to Steal Credentials, Cookies and Keystrokes

   cyberpress.org · 62d ago · August 12th, 2026

   Cybercriminals are using a fake CCleaner installer to infect Windows users with GhostDesk, a malicious Chrome extension designed to spy on browsing activity and steal sensitive information. CCleaner is one of the most widely recognized PC-cleaning utilities, with more than 2 billion downloads worldwide. Its popularity makes it a valuable lure for threat actors, who can abuse user trust in the brand to deliver malware through convincing download pages. The campaign uses a fraudulent website, ccleanerwind[.]top , made to resemble the legitimate CCleaner website. The page reportedly offers both normal and CCleaner Pro download options, but each button delivers the same malicious executable. The downloaded file is named CCleaner.exe and uses the real application’s icon. However, it contains unusual metadata that does not match known legitimate CCleaner releases. Its internal name is svc_it7p , while its original filename is rt_mxk.exe . Researchers also identified similarly named files following the patterns svc_ and rt_ .exe . Fake CCleaner Spreads GhostDesk (Source: malwarebytes) Once executed, the fake cleaner starts a multi-stage infection chain that modifies Google Chrome and installs spyware components. The campaign uses the trusted appearance of a PC utility to make its file activity less likely to raise suspicion. Fake CCleaner Spreads GhostDesk The fake CCleaner executable first drops and launches a legitimate W

2. update from gbhackers.com

   Malicious CCleaner Installer Patches Chrome Security Extension to Deploy Browser Spyware

   gbhackers.com · 62d ago · August 12th, 2026

   A counterfeit installer for the widely used PC-cleaning utility CCleaner is being used to compromise Windows systems and deploy a malicious Chrome extension dubbed GhostDesk. CCleaner’s global popularity, with more than two billion downloads, gives attackers a credible pretext to target users searching for system-maintenance tools. The observed infection chain begins at ccleanerwind[.]top, a website […] The post Malicious CCleaner Installer Patches Chrome Security Extension to Deploy Browser Spyware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .