THREAT OPS › Threat News › Fake CCleaner installs GhostDesk Chrome spyware
Fake CCleaner installs GhostDesk Chrome spyware
<p class="wp-block-paragraph">A fake version of the popular PC cleaning tool CCleaner is being used to infect Windows users with a malicious Chrome extension called GhostDesk, which acts as spyware inside the browser. </p>
<p class="wp-block-paragraph">With more than 2 billion downloads worldwide, CCleaner is one of the best-known Windows utilities, making it an attractive target for cyber
MITRE ATT&CK techniques
Indicators of compromise
- c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23sha256
- 8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904sha256
- 3d7411e2e445a2210dbbf061f3e8e3dd3476a4fc5d4a2135dcceb0bc705776bfsha256
- cfd9c0bcc89ebc68aae889b9b49bc8290c3764bce5f2c9ac8b5ba0ba58e9bf61sha256
- 590b04e35fc0b3dcd9dabe82f2e96d4d1e0fccc598911cf80f8255232ee75fcbsha256
- ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32dsha256
- cfa3900cefb447d89a7498224f2ecafa65b190336934811e6c1d4196d9b92452sha256
- 0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56sha256
- 49c8d1669629b0a96e4ef05a44d03b68md5
- 193.169.240.81ipv4
- ccleaner.comdomain
- ccleanerwind.topdomain
- liderongrade.duckdns.orgdomain