🚨 Notepad++ Plugin Hijacked: Inside the UAC-0099 Malware Campaign
CERT-UA has linked threat actor UAC-0099 to a campaign trojanizing a legitimate Notepad++ plugin (NppExport.dll) to silently deploy malware on Windows endpoints — no software vulnerability exploited, just DLL sideloading and social engineering.
Attack chain: Phishing email → Shortened URL → ZIP archive → Fake PDF (VBS script) → Trojanized NppExport.dll plugin → Scheduled Task → LUNCHPOKE → BURNYBEAR → MATCHBOIL.V2
Notepad++ is exactly the kind of trusted, ubiquitous software that slips past scrutiny — which is why plugin ecosystems deserve the same supply chain rigor as core applications.
Detection starting points:
- Audit scheduled tasks for unfamiliar entries
- Check plugin directories for unsigned/recently modified DLLs
- Review PowerShell Event ID 4104 for suspicious script block activity
Mitigation checklist:
✅ Inventory and verify signatures of installed plugins
✅ Audit scheduled tasks across endpoints
✅ Enable DLL sideloading detection in EDR
✅ Review PowerShell execution logs
✅ Treat plugins as part of your supply chain risk model
Full IOCs, PowerShell detection queries, and mitigation guide: https://www.xpert4cyber.com/2026/07/notepad-plusplus-fake-plugin-malware.html
Curious if others have seen similar plugin-based supply chain attacks against lightweight/open-source tools — drop a comment if you have.
Top comments (0)