Kurzfassung
Cybercriminals are pushing a trojanized copy of the popular PC cleaner CCleaner through a convincing clone of the official download page (ccleanerwind[.]top). Once executed, the fake installer uses CScript to patch Chrome's Security...
Wie es funktioniert
Cybercriminals are pushing a trojanized copy of the popular PC cleaner CCleaner through a convincing clone of the official download page (ccleanerwind[.]top). Once executed, the fake installer uses CScript to patch Chrome's Security...
Warnzeichen
- The installer is served from a look alike domain (ccleanerwind[.]top), not ccleaner.com, and both "Free" and "Pro" buttons deliver the same malicious executable. Suspicious internal version metadata: internal name svc it7p and original filename rt mxk.exe , which never appear in legitimate CCleaner builds. After install, Chrome starts running unknown background.js and content.js scripts under the Security Extension folder with a WebSocket beacon to a DuckDNS domain
Was tun
- 1Only download CCleaner directly from ccleaner.com and verify the digital signature of the installer before running it. Check Chrome's extension list and remove any unknown entry related to the Security Exten
Quelle
malwarebytes
Quelle geprueft vom Mythos Forensic Team
https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spywareFAQ
Ist Fake CCleaner download page drops GhostDesk Chrome spyware on Windows users ein reales Betrugsmuster?
Ja. Behandeln Sie Nachricht, Anruf oder Zahlungsaufforderung als verdaechtig, bis ein offizieller Kanal sie bestaetigt.
Was sind die ersten Warnzeichen?
The installer is served from a look alike domain (ccleanerwind[.]top), not ccleaner.com, and both "Free" and "Pro" buttons deliver the same malicious executable. Suspicious internal version metadata: internal name svc it7p and original filename rt mxk.exe , which never appear in legitimate CCleaner builds. After install, Chrome starts running unknown background.js and content.js scripts under the Security Extension folder with a WebSocket beacon to a DuckDNS domain
Was sollte ich zuerst tun?
Only download CCleaner directly from ccleaner.com and verify the digital signature of the installer before running it. Check Chrome's extension list and remove any unknown entry related to the Security Exten
Kann LegalAudit meinen Fall pruefen?
Ja. Starten Sie den kostenlosen Chat und fuegen Sie Nachricht, Link, Absender oder Zahlungsdaten ein.