Loading story…
A malware campaign is using a fake CCleaner download site to infect Windows users with GhostDesk, a malicious Chrome extension that turns the browser into a surveillance and credential-theft platform. The installer triggers a multi-stage infection chain through cscript.exe, modifies Chrome’s Security Extension, and connects to attacker-controlled command-and-control infrastructure. Reporting indicates the operation also uses fake installers themed as 7-Zip and Adobe Acrobat, all tied to the same C2 domain.
Once installed, GhostDesk loads JavaScript components that enable keylogging, theft of credentials and cookies, screenshot capture, and clipboard manipulation targeting cryptocurrency strings. The malware can also inject scripts into web sessions and execute arbitrary JavaScript inside the browser, giving attackers broad visibility into victim activity and the ability to interfere with online transactions and account access.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Analysis showed the fake installer launched a multi-stage infection chain via cscript.exe, patched Chrome's Security Extension, and deployed JavaScript components that enabled keylogging, credential and cookie theft, screenshot capture, clipboard manipulation, script injection, and arbitrary JavaScript execution. The malware communicated with attacker infrastructure at liderongrade.duckdns[.]org and used local WebSocket relays for command handling and exfiltration.
Researchers found a malware campaign using a fake CCleaner installer from a lookalike site to infect Windows users with a malicious Chrome extension called GhostDesk. The campaign also included similarly themed fake 7-Zip and Adobe Acrobat installers connecting to the same command-and-control infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecsoonline.com
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple active **social-engineering-driven malware operations** are targeting end users through trusted distribution channels. One campaign, dubbed **GhostPoster**, distributed **17 malicious browser extensions** across *Chrome, Firefox, and Edge* with **840,000+ installs**, using legitimate-sounding names (e.g., “Google Translate in Right Click,” “Youtube Download,” “Ads Block Ultimate”) and evading store reviews for years. The extensions used **steganography** to hide code in PNGs, then extracted payloads to contact attacker infrastructure, enabling credential/data theft, tracking, affiliate-link hijacking, script injection, and HTTP header manipulation to weaken protections. Separately, threat actors are impersonating **Malwarebytes** via trojanized ZIP “installers” (e.g., `malwarebytes-windows-github-io-X.X.X.zip`) and using **DLL sideloading**—pairing a legitimate EXE with a malicious `CoreMessaging.dll`—to execute **infostealers**; reporting highlighted a campaign fingerprint via **behash** `4acaac53c8340a8c236c91e68244e6cb` and distinctive DLL strings used for infrastructure mapping. A different operation identified by CloudSEK involves **“RedLineCyber”** masquerading as an affiliate of “RedLine Solutions” to build credibility inside private **Discord** communities and deliver a Python-based **clipboard hijacker** (often `Pro.exe` / `peeek.exe`) aimed at **cryptocurrency wallet theft**, relying on long-term grooming of high-value targets rather than broad phishing.
Jun 29, 2026
Push Security reported a new **ClickFix-style** social-engineering campaign dubbed **InstallFix** that uses **Google-sponsored search ads** to drive developers to near-identical cloned “install” pages for *Anthropic Claude Code* and similar AI coding tools. Victims are prompted to copy/paste terminal commands from the fake pages; executing them installs **Amatera Stealer**, enabling credential theft and potential access to enterprise development environments. Separate reporting highlighted adjacent browser-based tradecraft: a previously legitimate Chrome extension (*QuickLens – Search Screen with Google Lens*) with roughly **7,000 users** was updated to deploy **ClickFix** attacks, strip web security headers, and steal cryptocurrency wallet seed phrases before being removed from the Chrome Web Store. A weekly threat bulletin also noted unrelated incidents (e.g., ransomware and data breaches) and separate AI-themed malicious extensions that harvest LLM chat histories, but those items are not part of the InstallFix/Claude Code malvertising campaign itself.
Jul 12, 2026
Researchers reported multiple malware delivery campaigns using **malicious email**, **fake browser updates**, and likely **content injection** on compromised websites to install infostealers and remote access trojans. One campaign abused WordPress sites to present a fake **Google Chrome** update that delivered credential-stealing malware, while another used malicious **PEC** email lures tied to crypto-wallet themes to infect targets with remote access tooling and theft-focused payloads. Separate reporting also described spam operations distributing evasive malware through email, showing continued reliance on social engineering and web-based lures to gain initial access. The activity aligns with attacker use of **MITRE ATT&CK** techniques including `T1659` for content injection and `T1555` for stealing credentials from password stores. Once installed, these malware families commonly target saved passwords and account data from browsers, email clients, FTP/SFTP tools, Wi-Fi profiles, and Windows credential stores using utilities and methods associated with tools such as **LaZagne**, **Mimikatz**, **MailPassView**, and **Network Password Recovery**. The campaigns underscore a persistent threat pattern in which adversaries combine deceptive delivery methods with credential theft to expand access, move laterally, and compromise additional systems.
Aug 11, 2026