Warning: CCleaner Hacked with Malware

Avast disclosed that attackers compromised CCleaner's update infrastructure and injected malicious code into CCleaner v5.33 (and cloud v1.07), delivering a signed malicious installer over HTTPS that beaconed to hardcoded C2 IPs and DGA domains and selectively served a second-stage payload to about 20 targeted organizations (including Microsoft, Cisco, Intel, VMware, Sony), while ~700K users downloaded the compromised build; Avast revoked the signing certificate and released a clean update, and Zscaler published detections and protections including signatures, sandboxing, and recommendations for SSL inspection.