Fake CCleaner downloads turn Chrome into a credential-stealing surveillance tool

A malicious version of the CCleaner utility is being distributed through a fake download site, ultimately infecting Windows systems with a multi-stage malware that exploits Google Chrome for credential theft and surveillance. The malware, analyzed by Malwarebytes researchers, installs a Chrome extension called GhostDesk, which captures sensitive information such as credentials, cookies, and keystrokes, while also enabling attackers to inject arbitrary JavaScript code into active browser tabs¹. This campaign highlights a significant threat, particularly as state-aligned actors become involved, shifting the threat model from traditional cybercrime to geopolitical motivations. The use of a legitimate utility like CCleaner as a trojan horse underscores the importance of verifying software downloads from authorized sources. So what matters to practitioners is that this campaign's state-aligned activity necessitates a distinct approach to threat mitigation, one that accounts for the unique tactics and motivations of nation-state actors.