Cybercriminals are using a fake CCleaner installer to infect Windows users with GhostDesk, a malicious Chrome extension designed to spy on browsing activity and steal sensitive information This article explores malware replaces runtimebroker. . Its popularity makes it an attractive target for threat actors who can exploit user trust in the brand to deliver malware through convincing download pages.

Researchers also found similar files following patterns of svc_ and rt_.exe. A fake CCleaner executable first drops and launches a legitimate cscript.exe, then uses scripts to gather system information such as machine GUIDs, device names, and language settings. The malware also replaces runtimebroker.dll at %AppData%\Microsoft\DriverStore with a reflective loader that aids in loading additional malicious code on the compromised system.

The infection also establishes communication with an attacker-controlled infrastructure, creating a local WebSocket endpoint at 192.168.100.4:49727, which then connects to the command-and-control server liderongrade.duckdns.org on port 4444. This component records keystrokes entered into web forms and stores typed data in a buffer before forwarding it for processing after two seconds of inactivity or when the victim switches to another field.