GhostDesk: The Spyware Hiding Inside Fake CCleaner Installers

🚨 GhostDesk: The Spyware Hiding Inside Fake CCleaner Installers

Security researchers have uncovered GhostDesk, a spyware campaign that abuses trusted software brands — CCleaner, 7-Zip, and Adobe Acrobat — to silently hijack Chrome.

Technically, what stands out is the "living off the land" approach: instead of raw shellcode, the malware drops a legitimate cscript.exe (or wscript.exe in one variant) to run a chain of scripts, blending into normal admin activity. Persistence comes from overwriting a component at %AppData%\Microsoft\DriverStore\runtimebroker.dll — not the real Runtime Broker, which lives in System32.

The final payload modifies Chrome's extension manifest to load two local files, content.js and background.js, on every browser launch — no Chrome Web Store listing, no install prompt required.

Capabilities include:
🔑 Keystroke & credential logging
🍪 Session-cookie theft (bypasses MFA)
📸 On-command screenshot capture
💰 Clipboard hijacking for crypto wallet address swaps
🧩 Remote JavaScript injection into open tabs

Researchers traced the same C2 infrastructure to fake 7-Zip and Adobe Acrobat installers — this is a reusable delivery framework, not a one-off.

Full technical breakdown, IOCs, and detection/response guide:
👉 https://www.xpert4cyber.com/2026/08/ghostdesk-spyware-fake-ccleaner-malware.html