Malicious Notepad++ Plugin Used to Deliver Persistent Malware via DLL Hijacking
Threat actor UAC-0099 (linked to Sandworm/APT44) abused Notepad++'s plugin architecture by bundling a malicious plugin called LunchPoke within a ZIP archive disguised as the legitimate Notepad++ application. The attack exploited a DLL hijacking vulnerability in Notepad++ v8.8.3, allowing the plugin to establish persistence via scheduled tasks and load secondary malware payloads. This campaign highlights the danger of unvetted software distribution channels and unpatched third-party tools — even trusted, widely-used applications can become attack vectors when plugins are not verified. The combination of DLL hijacking and scheduled task persistence makes detection difficult without robust endpoint monitoring and application whitelisting in place.
Tactical Insight
Immediate actions
- Upgrade Notepad++ to the latest patched version to remediate the known DLL hijacking vulnerability in v8.8.3.
- Block execution of unsigned or unverified plugins by enforcing application control policies on all endpoints.
- Hunt for indicators of compromise (LunchPoke plugin, MatchBoil loader, suspicious scheduled tasks) across your environment.
Long-term improvements
- Maintain a software allowlist restricting which applications and plugins may execute on corporate endpoints.
- Enforce a verified, centrally managed software distribution process to prevent users from installing ad-hoc or bundled software packages.
- Implement DLL load order hardening and Safe DLL Search Mode across all Windows endpoints to reduce hijacking risk.
Detection measures
- Monitor for anomalous scheduled task creation events (Windows Event IDs 4698/4702) associated with non-standard executables.
- Deploy EDR/XDR tooling to detect suspicious DLL loads and plugin execution chains within trusted applications.
- Alert on ZIP archives delivered via email or web that contain both executables and DLL files consistent with plugin-based attack patterns.