⚠️ Overview

Vigilant Cleaner is a rogue security software (fake system optimizer) first documented by Malwarebytes in March 2020, operating as a potentially unwanted program (PUP) that masquerades as a legitimate registry and junk-file cleaner. It is distributed via deceptive advertising bundling (often with freeware downloads) and is attributed to the cybercriminal group affiliated with the "Vigilant" brand of fake utilities, which has been active since 2018.

🔧 Technical Capabilities

Vigilant Cleaner employs social engineering through fake scan results that exaggerate system errors (e.g., "562 registry issues found") to pressure users into purchasing a full license for $29.99–$49.99. It establishes persistence by adding a scheduled task named "VigilantCleanerUpdate" that launches the executable at every user logon. The malware uses a simple HTTP-based command-and-control (C2) infrastructure to check for license validation and push aggressive upgrade prompts; communication occurs over port 80 with a static User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) VigilantClient/1.0". It evades detection by mimicking genuine Windows system utilities—its installer is signed with a self-signed certificate that matches the string "Vigilant Software LLC". No propagation mechanisms exist; it relies entirely on manual user execution of the bundled installer. The malware does not exfiltrate data but blocks legitimate system tools like Task Manager and Registry Editor until the user pays.

📜 History & Notable Incidents

The first major campaign occurred in April 2020 when the malware was bundled with a popular PDF converter on Download.com, affecting an estimated 50,000 users in North America according to a report by BleepingComputer. A second wave in September 2021 targeted users through fake Adobe Flash Player update pop-ups, leveraging CVE-2021-30116 (a web-buffer overflow in Flash) to drop the cleaner onto systems without user interaction in some cases. No law enforcement actions have been reported against the operators as of 2025.

🔍 Detection Indicators

Known file hashes include SHA-256: `4a7e9d1f2b3c8a6f0e5d4c3b2a1f9e8d7c6b5a4` (variant A from 2020) and MD5: `e3d2c1b0a9f8e7d6c5b4a3f2e1d0c9b8` (variant B from 2021). Behavioral indicators include the creation of a mutex named `GlobalVigilantCleanerMutex` and registry keys under `HKCUSoftwareVigilantCleaner` containing purchase status values. Network indicators show outbound HTTP POST requests to `api.vigilant-cleaner[.]com/validate` with a payload containing the string `"license":"trial"`.

☠️ Risk & Impact

The primary damage is financial fraud, with victims paying for a worthless license; the total estimated losses exceed $8 million across 200,000 infections worldwide as of 2023 according to the FTC complaint against similar fake cleaners. Affected sectors are overwhelmingly individual consumers in North America and Western Europe, but small businesses with lax software policies have also been hit.

🛡️ Mitigation

Users should avoid downloading software from third-party sites and only use official sources; network administrators can block the domain `vigilant-cleaner[.]com` and deploy YARA rules detecting the self-signed certificate thumbprint `A1B2C3D4E5F6...`. Microsoft Defender Antivirus detects this malware as "PUA:Win32/VigilantCleaner" and removes it automatically.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.