Popular text editor Notepad++ compromised in WikiLoader malware attack

---

Popular text editor Notepad++ compromised in WikiLoader malware attack#### Security researchers at the AhnLab Security Emergency Response Center (ASEC) have uncovered a sophisticated malware campaign targeting the Notepad++ text editor.

The core of the attack, named “WikiLoader,” relies on a technique known as DLL hijacking. The attackers stealthily modified the default Notepad++ plugin, mimeTools.dll, to execute malicious code every time the text editor is launched. Since this plugin is bundled with every installation of Notepad++, users unknowingly trigger the infection as soon as they use the software.

There is also a file disguised as a harmless certificate, certificate.pem, which masks the encrypted shellcode, the first stage of the attack. The complexity increases when the malware rewrites the code in another plugin “BingMaps.dll” and inserts a thread into the kernel of the Windows process “explorer.exe”. This ensures persistence and makes the attack more difficult to detect.

The malware actively looks for processes commonly used for analysis. If one is running, it immediately shuts it down to avoid detection.

The attackers behind WikiLoader have a clear goal: to connect the compromised computer to a C2 server that cleverly masquerades as a WordPress login page, from which the resulting malware is downloaded.

The exact capabilities of this malware are not yet fully known.