Filed under: Cybersecurity — Malware & Browser Security — August 2026
What happened
Researchers found a fake website, ccleanerwind[.]top, built to look exactly like the real download page for CCleaner, the popular free PC-cleanup tool. Anyone who downloads and runs the “installer” instead gets a malicious Chrome extension called GhostDesk quietly installed, which logs every keystroke, takes screenshots of open browser tabs, steals saved passwords and login cookies, and swaps out any cryptocurrency address copied to the clipboard. The same fake-installer trick is being used to spread copies of 7-Zip and Adobe Acrobat, all reporting back to the same attacker-controlled server. This isn’t proof-of-concept research — it’s an active campaign already infecting real users.
Why it matters to your business
Free utilities like CCleaner and 7-Zip are exactly the kind of thing an employee downloads on their own without asking IT first, often after clicking a sponsored search result rather than the real vendor site. Once GhostDesk is running in someone’s browser, an attacker can capture their Microsoft 365 or Google Workspace login, banking session, or QuickBooks password the moment it’s typed — no phishing email required, and no obvious sign anything is wrong.
What to do this week
Remind staff to download software only from the official publisher’s site (ccleaner.com, 7-zip.org, adobe.com) and never from a search ad or a link in an email or chat. In Chrome, have everyone check chrome://extensions for anything unfamiliar — especially extensions not installed through the Chrome Web Store — and remove it. If your business allows it, restrict who can install new browser extensions or desktop software on work machines. Anyone who installed a “cleanup” tool recently should run a full scan with Windows Defender or your antivirus and change their Microsoft 365, email, and financial passwords as a precaution.
The bigger picture
Attackers increasingly skip email phishing altogether and just wait for someone to search for free software — a reminder that “I found it on Google” isn’t the same as “it’s safe.” — Fake CCleaner installs GhostDesk Chrome spyware
Not sure what’s actually installed on your office computers? Book a free consult — https://micro1tech.com/contact/