{"id":"ghostdesk-fake-ccleaner-chrome-spyware-aug-2026","category":"scam","status":"closed","title":"Fake CCleaner download installs GhostDesk Chrome spyware on Windows PCs","tldr":"A fake CCleaner download site installs GhostDesk, a Chrome add-on that steals passwords and cookies, logs keystrokes and takes screenshots. Windows users only.","summary":"Malwarebytes reported on 11 August 2026 that a lookalike CCleaner download page delivers a fake CCleaner.exe to Windows users. The fake copies the real program's icon and filename. Both the normal download button and a 'CCleaner Pro' button give the same file. Once run, it changes Chrome so that a malicious extension, labelled GhostDesk, loads every time the browser starts. Malwarebytes says the extension can log keystrokes, collect credentials, tokens and financial details typed into forms, steal cookies, take screenshots of the open tab, swap cryptocurrency addresses pasted into pages, and run commands in the tab. The same loader and control server were also used with fake 7-Zip and Adobe Acrobat installers. CERT-EU repeated the report in a September brief, saying the activity appears global, no threat actor is named and other fake installers may spread it. The number of infected people has not been reported. CCleaner's maker has not issued a statement in the sources reviewed. This is a fraud and malware campaign, not a software flaw, so there is no patch. Malwarebytes detects the installer as Trojan.Dropper.","action":"Download CCleaner, 7-Zip, Acrobat and similar tools only from the maker's official site, never from a search ad or look-alike link. If someone in your home has run a CCleaner installer from elsewhere, run a full scan with a trusted anti-malware tool, then change passwords and sign out of accounts from a different, clean device.","product":"CCleaner download (fake), Google Chrome on Windows","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["ccleaner","ghostdesk","chrome","windows","spyware","fake-installer","infostealer","browser-extension"],"affected":["Windows PCs where a fake CCleaner.exe from a lookalike download site was run","Google Chrome on those PCs","Fake 7-Zip and Adobe Acrobat installers using the same loader (per Malwarebytes)"],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"Fake CCleaner installs GhostDesk Chrome spyware","url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware","by":"Malwarebytes","date":"2026-08-11"},{"kind":"advisory","title":"CERT-EU Cyber Brief 26-09","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-09/","by":"CERT-EU","date":"2026-09-03"}],"started":"2026-08-11","closed":"2026-09-03","created":"2026-11-03T21:33:17.091Z","updated":"2026-11-03T21:33:17.091Z","cve_notes":[],"timeline":[{"at":"2026-09-03","added":"2026-11-03T21:32:34.430Z","kind":"other","text":"CERT-EU's Cyber Brief 26-09 included the campaign, citing the Malwarebytes report. It said the activity appears global, that no threat actor has been identified, and that it may spread through other fake software installers. It gave no recommendations for this campaign.","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-09/","by":"CERT-EU","patch":"na"},{"at":"2026-08-11","added":"2026-11-03T21:32:34.430Z","kind":"disclosed","text":"Malwarebytes described a lookalike CCleaner download site whose two download buttons, including a 'CCleaner Pro' option, both delivered the same fake installer. The installer modifies Chrome and adds a spying extension that calls itself GhostDesk. Malwarebytes also found fake 7-Zip and Adobe Acrobat installers using the same loader and the same control server.","url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spyware","by":"Malwarebytes","patch":"na"}],"url":"https://hard.fyi/live/ghostdesk-fake-ccleaner-chrome-spyware-aug-2026/","json":"https://hard.fyi/api/live?id=ghostdesk-fake-ccleaner-chrome-spyware-aug-2026"}