Fake CCleaner installs GhostDesk Chrome spyware 

A fake CCleaner download site (ccleanerwind.top) distributes a trojanized CCleaner.exe that uses a CScript-based multi-stage loader to patch Chrome’s Security Extension and install a malicious extension named GhostDesk; the extension enables keylogging, credential and cookie theft, screen capture, script injection, and exfiltrates data to a C2 at liderongrade.duckdns.org (193.169.240.81). The report includes technical details of the infection chain, persistence mechanisms, sample SHA256 hashes, related fake installers, and recommended defensive actions.