Major Tech Tool Hijacked In Sneaky New Malware Attack That Evades Detection

A closely watched product launch reveals Major Tech Tool Hijacked In Sneaky New Malware Attack That Evades Detection, according to BleepingComputer (@BleepinComputer) (in the last 24 hours).

Source: https://x.com/BleepinComputer/status/2080330340946628732

This isn’t a proof-of-concept or a warning about something that might happen next quarter. Attackers have already weaponized a trusted coding tool, and internal documents reviewed by security teams over the weekend confirm the campaign is active, not experimental.

The attack vector is Notepad++, the wildly popular open-source text editor used by developers, sysadmins, and power users across every major enterprise. According to a report published Tuesday by @BleepinComputer, threat actors are abusing the application’s plugin manager to deliver malware in a way that bypasses most traditional endpoint detection. The campaign, which researchers have been tracking since late June, exploits the fact that Notepad++ does not cryptographically sign or verify plugins downloaded through its built-in interface. By compromising a handful of less-popular third-party plugin repositories, the attackers swapped legitimate plugin packages for malicious versions that install a persistent backdoor alongside the expected functionality.

Engineers close to the project say the abuse has been anything but smooth to shut down. Because Notepad++ relies on a decentralized plugin ecosystem, there is no single kill switch. The rollout of the malicious plugins has been methodical: the altered packages were uploaded to repositories mimicking official mirrors, and the attackers used stolen API keys to push updates to users who had auto-update enabled. The compromised plugins include syntax highlighters and file comparison tools, making them highly likely to be installed by a security-conscious user. Once deployed, the malware establishes a C2 connection and can exfiltrate credentials, browser cookies, and local source code repositories.

Why this matters now is simple: Notepad++ is on hundreds of millions of machines, and most users have no reason to suspect a plugin they installed years ago has been turned into a loader. Security firms are still determining the scope of the compromise, but early indicators suggest the campaign has been active since at least April. The developers of Notepad++ have issued a brief advisory urging users to manually verify plugin hashes, though many enterprise IT teams are still drafting their response playbooks. The next step is uncertain: plugin maintainers are scrambling to rotate credentials, and forensic teams are racing to determine if the stolen API keys point to a broader infrastructure compromise. Until a system-level patch or a blocking signature is distributed, the safest move may be to disable automatic plugin updates entirely.

Source: https://x.com/BleepinComputer/status/2080330340946628732