Notepad++ Archives

The maintainer of Notepad++ has reported that state-sponsored attackers hijacked the utility's update mechanism to divert update traffic to malicious servers instead. The attack involves [an] infrastructure-level compromise that allowed malicious actors to intercept and divert update traffic destined for notepad-plus-plus.org, developer Don Ho stated. The compromise occurred at the hosting provider level rather than through weaknesses in Notepad++ code itself. Ho continued, "The precise mechanism through which this was realized is currently being investigated." The development comes a little over a month after Notepad++ released version 8.8.9 to solve an issue that resulted in traffic from WinGUp, the Notepad++ updater, being "occasionally" routed to malicious domains, resulting ...

A recent malvertising effort on Google Search uses sophisticated ways to avoid detection and analysis as it targets users who want to download the well-known Notepad++ word editor. Malicious actors have been exploiting Google Ads more frequently to advertise phony software websites that propagate malware through malvertising campaigns. The Notepad++ malvertising campaign has been active for a few months, but Malwarebytes, who first discovered it, claims that it has remained hidden for that entire period. Although the exact payload that was sent to the victims is unknown, Malwarebytes believes it was most likely Cobalt Strike read more Malicious Notepad++ Google ads evade detection for months. Stay informed with the best cybersecurity news and raise your cybersecurity awarenes...

Tag: Notepad++

Notepad++ Official Update Mechanism Hijacked to Deliver Malware to Select Users

Malicious Notepad++ Google ads evade detection for months