MalwareBleeping Computer
8.4 — CRITICAL
Hackers abuse Notepad++ plugins to stealthily install malware
Ukraine's CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Hackers abused Notepad++ plugins to stealthily install malware, specifically using a DLL hijacking vulnerability (CVE-2025-56383) in version 8.8.3 to establish persistence and deliver MatchBoil V2 malware.
⚙️Technical Details
💥Impact Assessment
Severity: high
Who Is at Risk
Ukraine-based organizations and potentially other organizations with Notepad++ installed
🛡️Recommended Actions
1Update Notepad++ to version 8.9.7
2Update WinRAR to version 7.23
3Regularly update software and plugins to prevent exploitation of known vulnerabilities
📦Affected Products
Software:Notepad++WinRARHardware:
🔐NVD Verified DataVERIFIED
CVE-2025-56383 ↗CVSS 8.4 — HIGH
Attack Vector
LOCAL
Complexity
LOW
Vector String
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-427
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.