A convincing fake version of the widely used CCleaner utility is being used to deliver a multi-stage Windows malware that ultimately abuses Google Chrome for credential theft and surveillance.
Researchers from Malwarebytes found the campaign distributing a malicious Chrome extension called GhostDesk, which can capture credentials, cookies, keystrokes, and screenshots while also allowing attackers to inject arbitrary JavaScript into active browser tabs.
Attackers created a lookalike CCleaner download site and used it to distribute a malicious “CCleaner.exe,” researcher Sav Wheeler said in a blog post.
Alongside GhostDesk, the researchers also identified fake 7-zip and Adobe Acrobat applicatio...