Fake CCleaner sites are pushing a multi-stage loader that ends with a persistent Chrome extension named GhostDesk, designed to exfiltrate browser data. This is a classic supply-chain-adjacent attack targeting users searching for system utilities.
Technical Breakdown – Initial Access (T1566.002): Victims land on a lookalike domain (e.g., ccleaner-download[.]com) via malvertising or SEO poisoning. – Execution (T1204.002): The downloaded installer runs a PowerShell script that pulls a .NET loader from a remote C2. – Persistence (T1547.001): The loader writes a scheduled task to re-infect on reboot. – Defense Evasion (T1055.012): The final payload injects into chrome.exe to sideload the GhostDesk extension. – Collection (T1115): GhostDesk requests permissions for cookies, tabs, and webRequest to steal session tokens, credentials, and browsing history. – IOCs: The extension communicates with ghostdesk[.]top over HTTPS. No hashes provided in the report, but the installer is signed with a stolen or self-signed cert mimicking "Piriform Ltd."
Defense Block execution of unsigned PowerShell from Office/Download folders. Monitor for chrome.exe spawning child processes or loading unsigned extensions via registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions. Enforce an allowlist for Chrome extensions in enterprise environments.
Source: r/SecOpsDaily · by /u/falconupkid