Yes—an official CCleaner release was compromised. The 32-bit Windows version 5.33, released on August 15, 2017, carried a malicious payload while retaining a valid Piriform digital signature and was served from CCleaner’s legitimate download infrastructure. Cisco Talos and Avast suspected that part of Piriform’s development or build environment had been compromised, but the available reporting did not establish the attacker or the exact intrusion method.
Which CCleaner release contained malware?
The affected software was CCleaner 5.33 for 32-bit Windows. Talos reported that this build was released on August 15, 2017, and remained available from the legitimate download server during the period before version 5.34 appeared on September 12. The malicious executable was signed with a valid certificate issued to Piriform, CCleaner’s developer at the time. Cisco Talos’ technical advisory explains the binary and distribution timeline.
That signature showed that the file came through an authorized signing process; it did not prove that the code inside was safe. The incident is therefore a supply-chain compromise, not a case of users downloading an obviously fake copy from an unrelated website.
What the malware did
The compromised 5.33 installer still performed CCleaner’s normal functions, but the 32-bit binary also contained a multi-stage payload. Talos observed a loader and DLL, a delay before activity, privilege checks, collection of system information, and encoded or encrypted data sent toward command-and-control infrastructure. The malware attempted HTTPS communication and included a domain-generation fallback if its primary communication path failed. These observations are documented in Talos’ analysis.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
The presence of the extra code did not mean every installation was proven to have received a later-stage payload or suffered identifiable damage. The reporting established that the release was malicious and capable of collecting information and communicating outward; it did not provide a count of confirmed secondary compromises.
How the incident was discovered
| Date | Account | What was reported |
|---|---|---|
| August 15, 2017 | Cisco Talos | CCleaner 5.33 was released. |
| September 12, 2017 | Talos and Avast accounts differ | Talos said Cisco identified the installer on September 13 while beta-testing detection technology and notified Avast that day. CyberScoop reported that Avast said it found suspicious activity on September 12 and that Cisco informed Avast on September 14. |
| September 11, 2017 | Cisco Talos | The malicious 5.33 release was observed on the legitimate download server as recently as this date. |
| September 12, 2017 | Talos | CCleaner 5.34 was released. |
| September 18, 2017 | Talos and CyberScoop | Technical and news reports described the compromise and historical mitigation advice. |
The differing September 12–14 discovery and notification dates reflect separate statements, not one settled chronology. CyberScoop’s contemporaneous account, by Chris Bing, is available at CyberScoop.
Rank #2
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Was Piriform’s build system hacked?
Talos linked the valid signature and a build artifact to a likely compromise of part of the development or signing environment. Its advisory also left open an insider or compromised account as possibilities. Avast’s spokesperson, as reported by CyberScoop, called modification of the Piriform build environment the most likely attack vector.
“Anytime a malware sample is signed with actual certs you have to question the integrity and security of your build system”
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Rank #3
Sale
McAfee Total Protection 2027 Antivirus Software for 3 Devices | Auto-Renews
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
CyberScoop identifies that September 18, 2017 statement as a tweet by Craig Williams, a Talos senior researcher. Talos itself wrote: “The presence of a valid digital signature on the malicious CCleaner binary may be indicative of a larger issue that resulted in portions of the development or signing process being compromised.” Neither source proved who carried out the attack or exactly how access was obtained.
How many computers were affected?
| Figure | What it represents | Attribution and qualification |
|---|---|---|
| 2.27 million users | Estimated installations of the affected software on 32-bit Windows machines | Avast estimate reported by CyberScoop in 2017; not a count of systems shown to have suffered follow-on harm. |
| More than 2 billion downloads | Cumulative historical CCleaner downloads | Claim reported by CyberScoop in 2017; Talos separately said CCleaner claimed this total as of November 2016. It is not a count of unique active devices or infections. |
| 5 million additional users per week | CCleaner’s claimed growth rate | Attributed by Talos to CCleaner’s 2017 claim and not independently validated in the advisory. |
The 2.27 million figure is the number most often associated with the incident, but its scope matters: it estimated installations of 32-bit CCleaner on Windows, not confirmed malware damage across 2.27 million machines. CyberScoop’s report is at https://cyberscoop.com/ccleaner-malware-avast-cisco-talos/.
Rank #4
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
What should an affected user have done?
Talos’ September 18 historical recommendation was to restore an impacted system to a state before August 15, 2017, or reinstall it, then update to the latest version available at that time, 5.34. That was incident-response guidance for 2017, not verified current vendor guidance. The safest interpretation today is that an old installation should not be treated as evidence of a present infection or as a substitute for current security procedures; organizations investigating a machine from that period should use their own incident-response, backup, and reinstallation standards.
Buying a cleanup utility or antivirus product was not identified by these reports as a specific remedy. The key risk was the trusted distribution and signing path, so removing the compromised release and assessing the system mattered more than choosing a particular consumer product.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchBest Value
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Why the CCleaner case mattered
- A legitimate update channel can distribute malicious code when the build or signing process is compromised.
- A valid code-signing certificate authenticates the publisher’s signing key; it does not independently validate every component of a build.
- Incident figures need precise definitions: installations, downloads, active devices, and confirmed secondary compromises are different measurements.
- Technical findings and attribution are separate. Talos documented behavior and indicators, while the available accounts did not identify a proven attacker.
Bottom line
CCleaner 5.33 for 32-bit Windows was a genuine, signed release containing malware and distributed from the legitimate server in August and September 2017. Avast’s estimate of 2.27 million affected installations describes exposure to that release, not proof of equal numbers of damaged computers. The evidence pointed toward a compromised Piriform build environment, but it did not settle who was responsible or precisely how the compromise occurred.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
