A fake version of the popular PC cleaning tool CCleaner is being used to infect Windows users with a malicious Chrome extension called GhostDesk, which acts as spyware inside the browser. 

With more than 2 billion downloads worldwide, CCleaner is one of the best-known Windows utilities, making it an attractive target for cybercriminals looking to distribute malware. 

The attack starts with a website that is a convincing imitation of the CCleaner download page. Once installed, the fake application launches an attack that modifies Chrome, installs malicious extension components, and gives attackers the ability to steal credentials, capture screenshots, and log keystrokes. 

The fake application likely uses the guise of a PC cleaner to make its file and system activity appear less suspicious. 

Under the hood, the malware uses CScript to launch a multi-stage infection, patches Chrome’s Security Extension, establishes a command-and-control (C2) channel, and ultimately installs a malicious Chrome extension identifying itself as GhostDesk. 

Technical analysis 

First stage: CScript loader and injection 

We found the initial infection vector, a fake CCleaner.exe, on a website designed to imitate the official CCleaner.com home page: ccleanerwind[.]top. 

Although the page had a CCleaner Pro download option next to the normal download button, both buttons downloaded the same malicious executable.  

The fake CCleaner.exe uses the same icon and filename as the legitimate CCleaner application, but contains unusual version information. Its internal name (svc_it7p) and original filename (rt_mxk.exe) don’t match up with any known CCleaner release. We also found other files following this version naming pattern (svc_<4 random characters> and rt_<3 random characters>.exe) that launch this infection chain. 

The executable initially drops a legitimate instance of CScript (cscript.exe), then uses it to launch a series of scripts that do the following: 

• System reconnaissance: Queries the registry for the machine GUID, name, and supported languages. 
• Hijacked Runtime Broker: Writes to %AppData%\Microsoft\DriverStore\runtimebroker.dll, replacing it with a reflexive loader for additional malware. 
• Chrome Security Extension patch: Patches the Chrome Security Extension’s manifest.json to include a service worker (background.js) and content script (content.js). These JavaScript files are then dropped in the %LocalAppData%\cse folder. 
• C2 connection: Creates a local WebSocket endpoint on 192.168.100.4:49727 and upgrades this endpoint to connect to the public domain/port liderongrade.duckdns[.]org:4444. Once connected, it sends a GET request with a token and then receives regular keep-alive packets from the attacker’s server. 

Second stage: Malicious Chrome extension 

The two JavaScript files written by CScript, content.js and background.js, serve as the final payload. Because of the patched Chrome Security Extension (CSE) manifest, background.js runs silently in the background whenever Chrome starts, while content.js runs as the main extension.  

The two scripts perform different spyware functions but are interdependent, maintaining a two-way communication through chrome.runtime.sendMessage and chrome.runtime.onMessage.addListener.  

content.js performs the following: 

• Keylogging: Records keystrokes entered into input fields and sends them to a buffer. After two seconds of inactivity, or when the user switches fields, the contents of the buffer are sent to background.js for handling. 
• Form-based credential harvesting: The script listens for outgoing POST requests and submit events, acting as a man-in-the-middle to capture submitted data. It monitors these forms for specific keywords related to credentials, authentication tokens, and financial information. If any of these keywords are found, it sends the contents of the form to background.js for handling. 
• Cryptojacking: The script monitors clipboard paste events, looking for references to cryptocurrency strings. When one is detected, it replaces the pasted result with a predefined value. 
• Script injection: For pages with certain URL patterns, <script> elements are dynamically injected into the webpage and certain elements are replaced. 

Meanwhile, background.js stores configuration data used for recognizing functionality-relevant strings (cryptocurrency addresses, JS injection rules, and toggles for form capture and keylogging), and does the following: 

• WebSocket-based exfiltration: The script opens a local WebSocket relay on 127.0.0.1:7345/ext, sending and receiving data and commands. It has persistence capabilities, re-establishing the relay if connection is lost when Chrome starts or the extension is installed. 
• Cookie theft: The script uses chrome.cookies.getAll to grab the user’s browser cookies and send them to the WebSocket relay. 
• Screen capture: The captureTab function sends a screenshot of the active browser tab to the WebSocket relay. 
• Arbitrary code execution: The injectJS function uses chrome.scripting.executeScript to execute arbitrary JavaScript code in the active browser tab. 

These extensions label themselves as GhostDesk, which is also the name of legitimate overlay software that allows AI agents to capture and interact with the user’s screen. The choice of name may help disguise their screen-capture functionality, although the extensions don’t attempt to hide their other malicious behaviors. 

How to stay safe 

Like many Trojans, this campaign takes advantage of the reputation of a popular app by distributing malware through a convincing lookalike website. A professional-looking download page isn’t enough to prove a site is legitimate.  

Here are some tips to reduce your risk: 

• Carefully check the web address before downloading software. Sponsored search results are not always trustworthy and can be abused by cybercriminals. Treat any links to software downloads on social media, SMS, and email with caution. 
• If possible, verify download links through trusted sources such as the Microsoft Store or Google Play Store, or the publisher’s official website. 
• Use an up-to-date, real-time anti-malware solution with web protection. Malwarebytes blocks connections to unsafe sites like this one, and detects the fake CCleaner installer described here as Trojan.Dropper. 
• Keep your operating system, browser, and security software up to date. 

Indicators of compromise (IOCs) 

• Domain: ccleanerwind[.]top — Fake CCleaner download site 
• Domain: liderongrade.duckdns[.]org — Command-and-control server (C2) 
• IP: 193.169.240[.]81 — Command-and-control server (C2) 
• SHA256: c0b4a4af8a3a8c4b113d7f203fcf480cfac79160102490daf287748634b9ce23 — Fake CCleaner.exe
• SHA256: 8d921bdd1f5bc8c03209a5dfacfd9ed313497ac2e3f1b4a2000f4c474a464904 — Reflexive loader replacing runtimebroker.dll
• SHA256: 3d7411e2e445a2210dbbf061f3e8e3dd3476a4fc5d4a2135dcceb0bc705776bf — content.js GhostDesk extension 
• SHA256: cfd9c0bcc89ebc68aae889b9b49bc8290c3764bce5f2c9ac8b5ba0ba58e9bf61 — background.js GhostDesk extension 

Other infection vectors 

While tracing this campaign, we found a series of other fake apps with identical behavior. The following programs use the same CScript loading to deliver a spyware payload: 

• 590b04e35fc0b3dcd9dabe82f2e96d4d1e0fccc598911cf80f8255232ee75fcb — Fake 7-Zip 
• Ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d — Fake Adobe Acrobat 
• Cfa3900cefb447d89a7498224f2ecafa65b190336934811e6c1d4196d9b92452 — Fake Adobe Acrobat  

All of these samples connect to the same C2 server, liderongrade.duckdns[.]org.  

We also identified another fake Adobe Acrobat sample that uses wscript.exe instead of cscript.exe. Its SHA256 hash is:  

0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56 

Picked up something you shouldn’t have?

RUN A FREE VIRUS SCAN

Most of us are wise to phishing emails that don’t contain much personal information. Generic “your account is suspended” messages usually get binned on sight. But what about the phishing emails that use your real name and address, and reference the specific product you bought last month? Even for the most suspicious of people, that can be convincing.

It’s also the situation European Steam hardware buyers walked into this week. On August 10, Valve, the company behind the Steam gaming platform and Steam hardware, warned customers that a cyberattack had exposed names, home addresses, phone numbers, Steam email addresses, and details of their hardware orders.

It wasn’t Valve itself that got hacked. Rather, it was its shipping partner CEVA Logistics, which handles delivery of hardware from the gaming store. Passwords and payment information were not touched.

What got stolen

The attack window ran from July 29 to August 1, 2026. Valve learned about it on August 7 and started notifying customers three days later. CEVA stores delivery data for roughly 90 days after shipment, meaning anyone who received a Steam Deck, Steam Controller, or Steam Machine in Europe over the past three months could be affected.

The exposed information may include:

• Name
• Street address, postal code, and city
• Country
• Phone number
• Email address linked to the customer’s Steam account
• The type and price of the ordered hardware

Exact numbers are still unconfirmed. Neither Valve nor CEVA has said how many customer records were involved. Dutch retailers Bol and De Bijenkorf were reportedly told about the same CEVA incident on August 1 and warned their own customers.

Why shipping data is valuable to scammers

A scammer can send an email, text, or even make a phone call that references your genuine order and delivery address before asking you to pay a small customs or redelivery fee, confirm your delivery, or sign in to “verify” your order.

Scam or legit? Scam Guard knows.

TRY IT NOW

Data like this is already widely traded online. Malwarebytes researchers found more than 7,500 compromised datasets containing over 8.4 billion records on the dark web during the first six months of 2026.

Not Valve’s first security incident

Although Valve’s own systems weren’t compromised, that doesn’t mean the consequences can’t be severe.

In May 2025, a threat actor called Machine1337 tried to sell what looked like a dataset of 89 million Steam user records for $5,000. The data turned out to be older SMS messages carrying expired two-factor codes, routed through a third-party intermediary Valve says it never partnered with.

Valve has suffered a direct breach in the past though. November 2011 saw one that exposed records from 35 million users, including usernames, emails, and encrypted credit card details.

What affected buyers should do

In an email to customers, Valve advises them to assume that any message referencing their recent Steam hardware order is fake. That covers email, SMS, and phone calls, even the ones that quote your address correctly.

Steam Support never contacts users through email, Steam Chat, or Discord, and only handles account problems through its help page.

So you don’t need to rush to reset your password, although it never hurts to use a strong, unique password and enable Steam Guard’s two-factor authentication. Instead, be skeptical of any unsolicited emails, texts, or calls about a recent Steam hardware delivery, even if they include details only a real customer would know.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

A video game about drone warfare may look like an unusual cybersecurity story. But cybersecurity isn’t only about malware or stolen passwords. Sometimes it’s about understanding how online platforms are used to influence decisions, build trust, and persuade people to share personal information or take actions they otherwise wouldn’t.

According to Straight Arrow News, the online game Drone Battle: Ukraine is linked to Russia’s Alabuga Special Economic Zone in Tatarstan, a site associated with the production of attack drones used in the war against Ukraine. Investigators say the game is the latest part of a broader campaign that has used major social media platforms, including YouTube, TikTok, Instagram, and X to reach young people.

The game is just the lure. Investigators say it forms the entry point to a recruitment funnel that markets education, careers, travel, community, and technological opportunity to young people before ultimately steering some recruits toward jobs assembling drones at Alabuga.

Available in English, Russian, and Chinese, Drone Battle: Ukraine presents a stylized conflict between Russia and NATO. But investigators say the game is only one part of a larger campaign that combines games, esports tournaments, influencers, and career messaging to recruit young people globally into Russia’s drone industry.

This campaign is not limited to drone combat. The same channels have also promoted games that frame construction work, teamwork, strategy, and professional development as challenges to be completed and levels to be unlocked.

That’s gamification serving a recruitment purpose. The game doesn’t have to persuade someone to take a job on its own. It only needs to make participation feel like a game, make a military-industrial workplace appear modern and exciting, and make the transition between the two seem natural.

Gamification itself isn’t unusual. Companies use games, quizzes, competitions, and rewards in education, training, and recruitment every day. The concern here is how those familiar techniques are combined with social engineering to influence decisions while obscuring the true nature of what’s being offered.

Social engineering

Social engineering is often described as a way of tricking people into giving up a password or opening a malicious attachment. But at its core, social engineering is the manipulation of human decisions. This campaign appears to use several familiar techniques at once.

• Targeting: Investigators say Drone Battle: Ukraine is described in a registered patent as an “assessment tool in game form.” Rather than simply entertaining players, the game appears designed to engage people who may be receptive to later recruitment.
• Baiting: The campaign advertises scholarships, training, free travel, housing, and career opportunities while, according to investigators, downplaying or concealing the true nature of the work.
• Influencers: Social media promotions and seemingly personal testimonials make the campaign more persuasive than a straight-up advertisement.
• Normalization: A drone in a game is a tool to use for victory and fun. Researchers have warned that game-like recruitment can make militarized narratives feel routine, technical, and emotionally distant.
• Small steps: It starts with playing a game or following an account. People may then join a tournament, communicate with a recruiter, submit personal details, travel, and only later discover the full nature of the work. As with many social engineering campaigns, each interaction asks for a little more commitment, making the next step feel less significant than it really is.

Social platforms are taking action

US-based social media platforms have increasingly taken action against Alabuga-linked accounts after investigations alleged deceptive recruitment practices and human rights abuses associated with the campaign.

Social media platforms have been trying to disrupt the campaign for nearly two years. Following an Associated Press investigation in 2024, Google, Meta, and TikTok removed accounts linked to Alabuga Start for violating their policies. But according to the Foundation for Defense of Democracies (FDD), the organizers later created new accounts and continued recruiting across multiple platforms.

More recently, Ukraine’s Minister of Foreign Affairs, Andrii Sybiha, said that roughly 600 videos promoting Alabuga were removed from YouTube. The videos had been posted across hundreds of channels with a combined audience of more than 500 million subscribers. He wrote:

“The work does not end with removals. We will be now pursuing sanctions against individual bloggers who accepted payment to promote a sanctioned weapons manufacturer to millions of viewers.”

According to the Straight Arrow News investigation, however, the campaign remains active on X and Telegram.

How to stay safe

For home users, the traditional scam advice still applies: Independently verify a prospective employer, search for complaints and reporting, discuss an offer with someone you trust, and never pay to get a job.

Gamers should treat unsolicited career, travel, competition, and “exclusive training” offers with the same caution they would apply to any job pitch that feels unusually generous or vague. Offers to turn your gaming into a paid job should also be treated as “too good to be true.”

Other actions that might go a long way

Friends, families, educators, and youth organizations should talk openly about recruitment tactics without assuming that people targeted by them are naïve. They are often drawn in through a series of small steps that feel natural.

Platforms should investigate networks, influencer relationships, referral links, and coordinated messaging, not just individual posts or game titles.

Game developers and community platforms need reporting systems that are easy to find and will cater to recruitment concerns, not just cheating or abusive chat.

Governments and civil society groups in targeted countries need practical awareness campaigns that explain the specific promises being used and offer credible alternatives for education and employment.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

The FBI has issued a Public Service Announcement (PSA) warning that criminals are breaking into social media and personal accounts to steal and distribute intimate images and videos without consent. The FBI refers to this type of content as non-consensual intimate images (NCII).

The stolen material may be posted or sold on criminal marketplaces alongside victims’ names, phone numbers, email addresses, and social media handles, creating opportunities for harassment, stalking, and sextortion.

According to the FBI, criminals use a mix of account takeover and social engineering tactics:

• Password and PIN guessing: Criminals make high-volume login attempts using data from breaches, public social media profiles, leak sites, and other publicly available sources. Known victims may be targeted using name variations, birth dates, and other predictable personal details.
• Fake customer service texts: Victims receive a message claiming their social media account will be locked or disabled. The criminal triggers a legitimate password reset request, then persuades the victim to hand over the resulting verification code.
• Phishing emails: Lookalike support domains and email addresses warn of a “new login” and direct victims to a fake password change page designed to steal credentials.

This is different from the familiar “I recorded you” sextortion email, which typically relies on intimidation rather than a real account compromise. Still, if such an email includes a password you still use, change it immediately wherever it remains in use.

How to stay safe

There are several ways to reduce the risk of becoming a victim:

• Avoid storing sensitive images on social media platforms or other internet-connected services when possible. Breaches and leaks happen, and those images can end up in the wrong hands.
• Use a password manager to create a unique, long password for every account. Don’t base passwords or PINs on names, birthdays, or other public information.
• Turn on multi-factor authentication (MFA), preferably with passkeys or hardware security keys where available. MFA is valuable, but criminals can still phish one-time codes and session cookies, so never approve an unexpected prompt or share a verification code.
• Treat unexpected “account warning” links in texts and emails as suspicious. Open the service’s official app or type the known web address yourself instead. Don’t trust sponsored search results to take you to the correct website.

If you discover that intimate content has been stolen or shared, preserve any relevant links and evidence, secure the affected accounts, and report it through the FBI’s NCII reporting portal at ncii.ic3.gov.

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Young people use AI for everything. From schoolwork to interview prep, relationship advice to shopping decisions, the technology has become part of how young people live. For the most digitally fluent generation ever, AI is a competitive edge, a creative partner, and an always-on assistant. 

But the same technology making young people’s lives easier is also making the internet harder to navigate. AI is making scams more convincing, identities easier to manipulate, and online content harder to trust. Seven in ten (70%) 18-to-22-year-olds have experienced an AI-related scam in the last year, compared to half of the general population. And nearly every young person worries AI will be used against them. 

This isn’t happening because young people are reckless. It’s happening because the online platforms they rely on for everyday life now double as entry points for AI threats: social feeds where manipulated content and real content sit side by side, online marketplaces filled with fake storefronts and reviews, messaging channels where threats can be personalized, and AI tools that can make false information feel like the truth. 

That creates a new kind of safety burden. Young people are being asked to use AI, judge its output, protect their identities, and avoid increasingly personalized scams all at once. The result is a digital life that feels more powerful, but also more vulnerable to abuse. 

The internet is getting harder for young people to trust 

The internet young people grew up with isn’t the same one they’re facing today. AI has changed the landscape, making it harder for even these digital natives to know what information is credible and safe. Half of 18-to-22-year-olds strongly agree that it’s becoming harder to tell what content is genuinely human or real.  

Young people have had a front row seat to how AI can bend the truth. Nearly half have seen AI provide information they knew or later found out was wrong or misleading (44% versus 30% of the general population). Nearly one in four (23%) have suffered negative consequences because of AI advice, compared with 16% of the general population, and 18% say they have suffered emotionally from AI advice, compared with 12% of the general population. For a generation using AI in every corner of their lives, bad information can have lasting effects on their credibility, reputation, and relationships. 

Many young people have changed how they engage online as a result: 

• 47% of young people say AI has changed how much they trust reviews or content, compared with 37% of the general population 
• 35% say AI has changed how they shop online, compared with 26% 
• 32% say AI has changed how they present themselves professionally, compared with 20% 
• 19% say AI has changed how they date or communicate romantically, compared with 10% 

As one young person said about online dating:

“Dating isn’t an option for me online anymore. You just never know what is or isn’t AI, and I don’t want to spend a lot of time on someone fake.” 

AI is making it easier for scams to reach young people 

The harder it becomes to tell what is real, the easier it becomes for scams to work. For young people, AI is fueling a wave of scams that are more personal and invasive than ever before. 

• Nearly one in four young people have been a victim of an extortion scam of some kind (24% versus 17% of the general population). 
• Nearly one in five have been a victim of a deepfake or virtual kidnapping scam (19% versus 8%). 
• Nearly one in ten have been a victim of sextortion (8% versus 7%). 
• More than one in ten have been a victim of an impersonation scam (14% versus 10%). 
• More than one in ten have been a victim of a romance scam (12% versus 10%). 

What’s striking isn’t just how many young people have been victimized—it’s how many have been targeted: 

• More than half have been the target of an extortion scam (56% versus 42% of the general population). 
• 47% have encountered an impersonation scam (versus 35%) 
• 46% have encountered a romance scam (versus 33%). 
• More than four in ten have been targeted by a deepfake or virtual kidnapping scam (43% versus 26%).  
• Nearly four in ten have encountered sextortion (38% versus 24%). 

These scams may look different on the surface, but they all work the same way: they exploit fear, trust, shame, and intimacy. The more often young people encounter them, the more chances scammers have to find exactly which emotional triggers work. 

This exposure isn’t random. Young people are on social platforms at rates up to three times those of the general population: 89% use Instagram (versus 55% of the general population), 78% use TikTok (versus 38%), 68% use Snapchat (versus 26%), and 49% use Pinterest (versus 25%). Scammers can use these platforms to get everything they need to make their threats more convincing: public photos, friend networks, school affiliations, relationship clues, and everyday posts containing personal information. With AI, scammers can use that content to create explicit images, clone voices, impersonate profiles, and create threats personalized with details that are hard to ignore. 

One young person shared their experience:

“I had someone make fake nudes of me using AI on my photos from my social media and threaten to post them on Facebook after I realized that they had scammed me. I decided to be more careful with my personal information.”  

Young people fear AI will steal what money cannot replace: identity, reputation, and sense of self 

AI-fueled scams aren’t just scams in the traditional sense. They are forms of identity abuse. This is different from traditional identity theft. For young people, the risk isn’t only that someone steals a password or money. It’s that scammers can use AI to make them appear to say, do, or share something they never did, with consequences that can follow them in their personal and professional lives.  

That’s why young people are so concerned about AI being used against them. The fears that hit hardest: 

• 88% worry about AI being used to harm their professional or personal reputation versus 77% of the general population 
• 82% worry about someone creating a fake profile pretending to be them versus 76% 
• 81% worry about someone creating fake nude or sexually explicit photos or videos of them versus 62%; 15% say it’s happened to them already (versus 10%) 
• 80% worry about being deceived by someone using AI to fake their identity in an online relationship versus 67% 

These threats are especially powerful at a life stage where young people are still building their personal and professional reputations. A fake profile, manipulated image, or AI-generated explicit video can affect how everyone from classmates and professors to potential employers and romantic partners see them for years to come.  

Young people are pulling back online, but protection is still too manual 

Many young people are responding by retreating. 80% are sharing or posting less online than they were a year ago, versus 61% of the general population. Compared to the general population, more 18–22-year-olds have also taken AI-related protective measures like tightening privacy settings, removing unknown followers, using reverse image search to verify content, requesting data removal, and watermarking their own photos and videos.  

Those actions matter, but they also show how much responsibility has been pushed onto individuals. Staying safer online now means constantly reviewing settings, checking sources, questioning content, and so much more. That’s a lot to ask of anyone, and the fatigue is showing: 42% of young people say they receive so many warnings they have stopped paying attention, compared with 36% of the general population. It’s hard to sustain vigilance when new risks are always emerging. 

At the same time, completely opting out isn’t realistic. Young people remain deeply embedded in digital life, and they’re still some of AI’s most enthusiastic adopters: 74% say AI has had a positive impact on their lives, compared with 57% of the general population. They aren’t rejecting AI or the internet, but they are carrying more of the safety burden than they should have to.

What young people can do to help decrease their risk right now 

• Know the scams targeting you. Extortion, sextortion, deepfakes, and romance scams disproportionately target young people. If someone contacts you with threats of any kind, do not pay. Report it to the platform and to authorities. 
• Button up your social media. Everything you post publicly is available to anyone, including scammers. Tighten privacy settings on the platforms you use most and review your followers regularly. 
• Don’t trust product images alone. Before buying from an unfamiliar retailer, use reverse image search on product photos and look for independent reviews off the retailer’s own site. 
• Create a family code word. Make sure you agree on this word in person, not online. If you receive a panicked call from someone you know asking for money or information, verify they are who they say they are with the code word. 
• Don’t reuse passwords. If one password gets stolen in a data breach, it will likely get tried on all other accounts you might have. Use a different password for every account to keep your accounts locked down. 
• Turn on two-factor authentication on all your important accounts. Only 30% of young people have done this. It is one of the highest-impact protections available and takes under five minutes to set up. 
• Protect your devices. Use security software on all your devices, and keep all your software up to date to make sure you’re patched against all known security holes.

Malwarebytes Student Protection Program

If you’re a student or work at a university, Malwarebytes Student Protection Program provides two years of free Premium Security for three devices for all US college or university students, staff and faculty. 

This includes Malwarebytes device protection for laptops, tablets, and mobile phones with built-in scam protection. It protects against creepy trackers and ads, and blocks malware, ransomware, and cybercriminals themselves.

Sign up at malwarebytes.com/student.

About the research 

The research in this article is based on a March 2026 survey about AI, identity, and the collapse of digital trust and was conducted among 1,500 respondents in the United States, United Kingdom, Germany, Austria, and Switzerland. This article focuses on student-aged adults, defined as respondents ages 18 to 22, compared with the general population. 

Additional context comes from Malwarebytes’ 2025 research Tap, Swipe, Scam: How Everyday Mobile Habits Carry Real Risk, which looked at mobile scams and scam-related behaviors across the same markets. Both research studies were prepared by an independent research consultant and distributed via Forsta. 

TikTok Shop is a real, functioning e-commerce feature built into the TikTok app, allowing users to buy goods without ever leaving TikTok. As it’s grown in popularity, scammers have begun cloning its appearance.Storefronts that reproduce its look, its trust badges, and its category layout closely enough to pass a quick glance are showing up as entirely separate, unverified websites.

The short version

If a shopping site looks like TikTok Shop but you didn’t reach it from inside the actual TikTok app, treat it as an unknown third-party store, not an extension of TikTok. It might look like TikTok, but it’s the same risks as any sketchy online shop: paying for something that never arrives, or handing over card details to a site with no accountability behind it.

Fake TikTok Shops

Clone sites in this category tend to reproduce TikTok Shop’s homepage design closely enough that, at a glance, they could pass for the real thing.

They have matching color schemes, matching layout, and language borrowed directly from the platform, such as “curated products,” “trusted sellers,” and “secure service.”

Underneath, they typically show the same kind of reassurance badges the real platform uses: claims of platform-verified sellers, local delivery guarantees, and after-sales support windows.

None of that trust signaling is backed by anything. It’s copied language and copied visual design sitting on top of a site with no verified relationship to TikTok at all. Scammers borrow the legitimacy that TikTok Shop has built up, then use it to move products—or simply take payment—through a storefront TikTok has no oversight of.

Wholesale stores and fake loan offers

A related version of this scam leans into bulk or wholesale pricing, offering goods across categories like fashion, home, and beauty, again wrapped in TikTok’s name and logo. Some of these sites go a step further and add a consumer credit or “loan service” option directly into the site navigation, sitting alongside ordinary shopping categories.

A legitimate wholesale marketplace doesn’t typically need to offer consumer credit as a checkout feature. When it does, it’s worth treating as a separate red flag from the shopping itself. Loan applications typically ask for far more sensitive information than a purchase does, including identity documents, banking details, and other personal data. Handing that information to a site that’s already impersonating a major platform significantly increases the risk of fraud or identity theft.

The checkout is the real risk

Both scams point to the same underlying concern: it’s not really about whether the products are real. It’s about what happens when you enter payment information into a storefront with a fake identity and no accountability. The order may never arrive, leaving you out of pocket, and your payment details themselves could be stolen, reused, or resold.

How to stay safe

• Only use TikTok Shop from inside the official TikTok app, not a link from an ad, DM, or search result.
• Always check a website’s address before entering any payment information. A convincing homepage doesn’t mean a legitimate business sits behind it.
• Be skeptical of any shopping site that also pushes a loan, credit line, or financing offer at checkout.
• Pay with a credit card rather than a bank transfer where possible. It gives you a dispute path if the order never shows up.

Brand impersonation is one of the oldest tricks in e-commerce fraud. TikTok Shop’s badge system and trust language are simply the latest assets being borrowed.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

A website built to look almost exactly like CNN’s homepage is telling visitors to download “the new CNN app.” But it’s not CNN’s app, and has nothing to do with the news company.

The campaign doesn’t stop at CNN. It also uses fake Stremio and Avast installers hosted on similarly convincing lookalike sites, all targeting Windows users. The installers are part of the same campaign to trick people into installing legitimate remote-management software that’s already linked to the attacker’s account.

Instead of downloading the software they expected, victims install O&O Syspectr, a genuine, digitally signed remote administration tool used by IT teams to manage computers. In the wrong hands, that tool can give an attacker remote access to a victim’s PC, allowing them to run commands, install additional software, or explore files and data. The CNN, Avast, and Stremio lures all point back to the same Syspectr account.

Another lookalike site uses a fake crypto-mining browser game instead of a trusted brand, but delivers the same software from a different Syspectr account.

Here’s what we found, why your antivirus has no reason to stop it, and the one 10-second check that would have caught it every time.

What the fake CNN page looks like

The site copies CNN’s real homepage closely enough that most people wouldn’t look twice. It has current headlines, the same layout, and even a red “Live Updates” tag on a real story. A pop-up interrupts almost immediately: “Get the latest news first in the new CNN app—it’s live and free,” with a red Download button underneath.

The file behind that button is named CNN_App.setupad4693fd-d903-4791-8f58-975261c93ca2.exe—the same Syspectr installer that shows up under different branding elsewhere, down to the account ID embedded in the filename.

The same trick, impersonating other brands

A lookalike site at avast-premium[.]shop mimics Avast’s real download page closely, including the logo, review scores, and a blue “Free download” button for “Avast One.” The file behind it is named AVAST_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe.

Another malicious site, stremiotv[.]online, copies Stremio, a legitimate media-center app. The file it pushes visitors to download is named Stremio_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe.

Both carry the same account ID found in the CNN installer.

By impersonating trusted brands, the attackers trick visitors into installing the legitimate O&O Syspectr remote-access tool, which gives the attackers remote access to the victims’ computers.

A different kind of bait

Not every lure needs a trusted brand, however. 

syncminer[.]xyz invents its own hook instead: an “idle miner” browser game showing a slowly-ticking cryptocurrency balance, with a “Download Miner Plugin” button promising faster payouts. The identical site also runs at idleminer[.]pro with the same layout, same game, and same download.

Both distribute the same file, named oo-syspectr-setup9158bf2a-ff25-4290-b96c-2dc5eb310391.exe outright, carrying its own account ID that is different from the CNN, Avast, and Stremio lures we saw.

It’s not malware, which is why antivirus can miss it

Every one of these files is a real, digitally signed piece of software from O&O Software GmbH, a legitimate German company. Syspectr is sold openly to IT departments and gives an operator remote desktop control and an admin-level command line on whatever machine it’s installed on.

That’s why antivirus software may not stop it. Antivirus is designed to detect malicious software, not flag a legitimately signed business tool just because of how it arrived on a computer. The attacker only has to convince victims to install a legitimate remote-management tool that’s already linked to the attacker’s account.

The 10-second check that gives it away

On Windows, right-click any installer like this, choose Properties, and open the Details tab. Two fields—File description and Product name—identify every installer we examined as O&O Syspectr, alongside a copyright notice for O&O Software GmbH.

The filename can be changed by anyone distributing the file, but those embedded details come from the signed software itself. Changing them would invalidate the digital signature, so they reveal what the installer really is.

How we know these are connected

Every Syspectr installer includes the account ID of whoever generated it, embedded directly in the filename. The CNN-, Avast-, and Stremio-branded files all carry the exact same account ID, showing they were created from a single Syspectr account and simply reskinned for different lures.

The Syspectr installer distributed through the fake crypto-mining game carries a different account ID, suggesting either a second operator using the same playbook or the same group operating under another account.

What this tool can actually do

Syspectr is designed to let IT administrators manage computers remotely. Depending on the subscription level, that can include viewing system information, monitoring running processes and services, managing Microsoft Defender, and restricting USB devices.

The paid plans add the features that matter most to attackers. They allow an operator to remotely control the victim’s computer, browse files, run commands, install additional software, and make changes to the system as though they were sitting in front of it. Higher tiers add tools for managing large numbers of devices and, on compatible hardware, even allow remote access when Windows won’t boot.

These remote-control features aren’t available on free Syspectr accounts. They require a Premium subscription or higher.

O&O Software response

O&O responded quickly. Within days, the company disabled Remote Desktop and Remote Console access for free Syspectr accounts, restricting both to paid plans only.

O&O has since identified and suspended the abusive accounts, also blocking them from adding new devices. O&O’s analysis found the attackers relied exclusively on Remote Console, not Remote Desktop. The company says it will keep scanning for this pattern and tighten restrictions further if needed.

It’s a solid response and O&O clearly has a handle on how the abuse is happening. Not every vendor moves this quickly or this effectively when their software gets abused.

How to protect yourself

• Only download software from the vendor’s actual website. Search results and ads can lead to convincing fakes.
• Before running any installer you’re unsure about, on Windows you can right-click it, open Properties > Details, and check the File description and Product name fields.
• If you find O&O Syspectr installed and didn’t set it up yourself, uninstall it through Settings > Apps and run a full antivirus scan.
• If you ran an installer like this recently, change passwords for anything you accessed on that machine afterward from a clean machine.
• Protect yourself while browsing online. Malwarebytes Browser Guard blocks known scam and lookalike pages before you land on them.

Remember

Fake download sites don’t always deliver malware. Sometimes they deliver legitimate software that’s been weaponized by the person distributing it. That’s why it’s important to download software from the real vendor and, if something doesn’t feel right, check what the installer actually is before you run it.

Indicators of Compromise (IOCs)

Account ID 4693fd-d903-4791-8f58-975261c93ca2:

• app.cnn-news[.]net → CNN_App.setupad4693fd-d903-4791-8f58-975261c93ca2.exe
• avast-premium[.]shop → AVAST_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe
• stremiotv[.]online → Stremio_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe

Account ID  9158bf2a-ff25-4290-b96c-2dc5eb310391:

• syncminer[.]xyz → oo-syspectr-setup9158bf2a-ff25-4290-b96c-2dc5eb310391.exe
• idleminer[.]pro → oo-syspectr-setup9158bf2a-ff25-4290-b96c-2dc5eb310391.exe

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →