Listen to the episode
TLDR
Cybercriminals are pushing a trojanized copy of the popular PC cleaner CCleaner through a convincing clone of the official download page (ccleanerwind[.]top). Once executed, the fake installer uses CScript to patch Chrome's Security...
How it works
Cybercriminals are pushing a trojanized copy of the popular PC cleaner CCleaner through a convincing clone of the official download page (ccleanerwind[.]top). Once executed, the fake installer uses CScript to patch Chrome's Security...
Red flags
- The installer is served from a look alike domain (ccleanerwind[.]top), not ccleaner.com, and both "Free" and "Pro" buttons deliver the same malicious executable. Suspicious internal version metadata: internal name svc it7p and original filename rt mxk.exe , which never appear in legitimate CCleaner builds. After install, Chrome starts running unknown background.js and content.js scripts under the Security Extension folder with a WebSocket beacon to a DuckDNS domain
What to do
- 1Only download CCleaner directly from ccleaner.com and verify the digital signature of the installer before running it. Check Chrome's extension list and remove any unknown entry related to the Security Exten
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/threat-intel/2026/08/fake-ccleaner-installs-ghostdesk-chrome-spywareFAQ
Is Fake CCleaner download page drops GhostDesk Chrome spyware on Windows users a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
The installer is served from a look alike domain (ccleanerwind[.]top), not ccleaner.com, and both "Free" and "Pro" buttons deliver the same malicious executable. Suspicious internal version metadata: internal name svc it7p and original filename rt mxk.exe , which never appear in legitimate CCleaner builds. After install, Chrome starts running unknown background.js and content.js scripts under the Security Extension folder with a WebSocket beacon to a DuckDNS domain
What should I do first?
Only download CCleaner directly from ccleaner.com and verify the digital signature of the installer before running it. Check Chrome's extension list and remove any unknown entry related to the Security Exten
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.