CCleanup: A Vast Number of Machines at Risk
Summary: Cisco Talos found that the legitimate, signed CCleaner 5.33 installer distributed by Avast's download servers carried a multi-stage malware payload, with the affected version released August 15, 2017 and replaced by 5.34 on September 12. The 32-bit binary was signed with a valid certificate issued to Piriform by Symantec, and Talos notified Avast on September 13, 2017.
What's compelling: CCleaner reported over 2 billion total downloads by November 2016 and was adding 5 million users per week, so even a small infected fraction represents a large population of machines running a signed installer that passed signature checks.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026