Notepad++ plugin trick delivers new malware loaders

Hackers are using a legitimate copy of Notepad++ and a disguised plugin to install malware on Windows computers, allowing malicious code to run through the text editor’s normal extension-loading process.

The campaign has been linked to UAC-0099, a threat cluster known for targeting government bodies, defence organisations and strategically important enterprises in Ukraine. The revised infection chain, detected from mid-July, deploys two newly identified tools called LUNCHPOKE and BURNYBEAR, followed by an updated version of the MATCHBOIL malware loader.

The operation does not involve a confirmed compromise of Notepad++ itself or its official software distribution infrastructure. Instead, attackers package a genuine version of the application alongside malicious files and persuade victims to open the bundle. The technique is designed to make the infection appear less suspicious because trusted software executes the rogue component.

Victims initially receive a compressed archive containing a Visual Basic Script file disguised as a PDF document. Windows systems that hide known file extensions can make such files appear more convincing, increasing the likelihood that a recipient will launch the script.

Once executed, the script downloads another archive named Evernote. zip. That package contains Notepad++ version 8.8.3, the legitimate WinRAR utility, a password-protected archive called updater. rar and a malicious file named NppExport. dll.

The script creates a randomly named directory, places the files inside it and launches Notepad++. The application then loads NppExport. dll through its standard plugin mechanism. The rogue dynamic-link library is the malware identified as LUNCHPOKE.

LUNCHPOKE establishes persistence by creating a scheduled task, enabling the malicious process to return after a system restart or at a predetermined time. It also extracts the contents of updater. rar, including files named RemoteLibUpdater. exe and InitTest. dll.

RemoteLibUpdater. exe is the BURNYBEAR component. It launches InitTest. dll, which contains the updated MATCHBOIL. V2 loader. This layered approach separates the infection into several stages, making analysis harder and reducing the chance that a single security control will detect the complete operation.

BURNYBEAR includes a destructive fallback function. If it cannot launch its intended executable, the malware can consume large amounts of processor and memory resources. Such activity may slow the infected machine, interrupt normal work or cause applications to stop responding.

MATCHBOIL. V2 creates another scheduled task and maintains configuration data for command-and-control communications. It can update the address of the attackers’ server and use WinRAR to extract additional programs downloaded to the computer.

The final payload used in the July campaign has not been publicly identified. Investigators have also not disclosed the affected organisations or confirmed whether the attackers were seeking intelligence, credentials, documents or broader access to internal networks.

Earlier UAC-0099 operations relied heavily on phishing emails carrying links to file-sharing platforms. Messages were sometimes presented as court notices and directed recipients to double-compressed archives containing malicious HTML Application files. Those attacks deployed the MATCHBOIL loader, MATCHWOK backdoor and DRAGSTARE information-stealing malware.

The group has operated against Ukrainian targets for several years and has repeatedly changed its delivery methods, file formats and execution tools. Its campaigns commonly use legitimate Windows utilities, scheduled tasks, scripting engines and compressed archives to conceal malicious activity among ordinary administrative processes.

UAC-0099 has also been associated with gaining initial access that could support operations by more advanced threat actors. However, attribution in cyber operations remains complex because infrastructure, malware and access can be shared, sold or transferred between groups.

The Notepad++ technique highlights the security risks created when trusted applications automatically load components from nearby directories. Attackers frequently exploit this behaviour through DLL sideloading or plugin abuse, placing a malicious library where a legitimate program expects to find an authorised file.

The disputed vulnerability record CVE-2025-56383 describes DLL-loading behaviour affecting Notepad++ 8.8.3. The project’s developers have challenged its classification as a software vulnerability, arguing that loading plugins from the application’s plugin directory is an intended feature rather than a security defect.

That distinction does not prevent attackers from abusing the feature after persuading a victim to run a prepared software package. The attack therefore depends on social engineering and malicious file distribution rather than remote exploitation of a standard Notepad++ installation.