Notepad++ has released a security fix to plug gaps that were exploited by an advanced threat actor from China to hijack the software update mechanism to selectively deliver malware to targets of interest. The version 8.9.2 update incorporates what maintainer Don Ho calls a "double lock" design that aims to make the update process "robust and effectively unexploitable." This includes verification

notepad++hijacked update mechanism software update mechanism targeted malware advanced threat actor from china

9 more topics

china security fix 8.9.2 update double lock design robust and effectively unexploitable verification targets of interest deliver malware malware

Bleeping Computer

9 months ago

Notepad++ boosts update security with ‘double-lock’ mechanism

Notepad++ has adopted a "double-lock" design for its update mechanism to address recently exploited security gaps that resulted in a supply-chain compromise. [...]

notepad++double-lock update security update mechanism mechanism

5 more topics

design security gaps exploited supply-chain compromise

The Hacker News

9 months ago

Notepad++ Official Update Mechanism Hijacked to Deliver Malware to Select Users

The maintainer of Notepad++ has revealed that state-sponsored attackers hijacked the utility's update mechanism to redirect update traffic to malicious servers instead. "The attack involved [an] infrastructure-level compromise that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org," developer Don Ho said. "The compromise occurred at the hosting

notepad++official update mechanism update mechanism hijacked redirect update traffic

7 more topics

malware malicious state-sponsored attackers infrastructure-level compromise notepad-plus-plus.org hosting don ho

The Hacker News

1 year ago

New PHP-Based Interlock RAT Variant Uses FileFix Delivery Mechanism to Target Multiple Industries

Threat actors behind the Interlock ransomware group have unleashed a new PHP variant of its bespoke remote access trojan (RAT) as part of a widespread campaign using a variant of ClickFix called FileFix. "Since May 2025, activity related to the Interlock RAT has been observed in connection with the LandUpdate808 (aka KongTuke) web-inject threat clusters," The DFIR Report said in a technical

interlock rat variant filefix threat

The Hacker News

3 years ago

eScan Antivirus Update Mechanism Exploited to Spread Backdoors and Miners

A new malware campaign has been exploiting the updating mechanism of the eScan antivirus software to distribute backdoors and cryptocurrency miners like XMRig through a long-standing threat codenamed GuptiMiner targeting large corporate networks. Cybersecurity firm Avast said the activity is the work of a threat actor with possible connections to a North Korean hacking group dubbed

escan antivirus mechanism backdoors miners

1 more topics

threat

ZDNet Security

5 years ago