A fake version of the popular PC cleaning tool CCleaner is being used to spread a malicious Chrome extension known as GhostDesk, which operates as spyware. This attack begins with a clone of the CCleaner download page that installs malware disguised as the legitimate PC cleaner. Once installed, it alters Chrome, loading malicious extensions that enable attackers to steal credentials, capture screenshots, and log keystrokes.
The malware uses CScript for multi-stage infections, creates command-and-control connections, and incorporates keylogging and credential harvesting functions. To protect against such threats, users should verify software download links, utilize reputable anti-malware solutions, and keep their systems updated. Indicators of compromise include specific domains, IP addresses, and hash values associated with the fake application.