Hackers abuse Notepad++ plugins to stealthily install malware
Hackers use malicious Notepad++ plugins to install LunchPoke malware and establish persistence.
Ukraine's CERT has identified a campaign by threat cluster UAC-0099, linked to APT44 (Sandworm), that distributes a ZIP archive containing the legitimate Notepad++ application and a malicious plugin named LunchPoke. This plugin establishes persistence by creating scheduled tasks and loading further malware, including the MatchBoil V2 loader, potentially exploiting a DLL hijacking flaw in Notepad++ v8.8.3.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Notepad++?
Get an email when a new story names Notepad++, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actor UAC-0099 (linked to Sandworm/APT44) abused Notepad++'s plugin architecture by bundling a malicious plugin called LunchPoke within a ZIP archive disguised as the legitimate Notepad++ application. The attack exploited a DLL hijacking vulnerability in Notepad++ v8.8.3, allowing the plugin to establish persistence via scheduled tasks and load secondary malware payloads. This campaign highlights the danger of unvetted software distribution channels and unpatched third-party tools — even trusted, widely-used applications can become attack vectors when plugins are not verified. The combination of DLL hijacking and scheduled task persistence makes detection difficult without robust endpoint monitoring and application whitelisting in place.
What helps against this
How we list vendors- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — LunchPoke
- malware — MatchBoil V2
- malware — BurnyBear
- cve — CVE-2025-56383