CERT-UA: LunchPoke Malware Hides in Notepad++ Plugin
Ukraine's CERT-UA found attacks distributing a fake Notepad++ bundle that includes LunchPoke, a malicious plugin that establishes persistence on Windows.
Marisol "Fuse" Delgado Ukraine’s CERT-UA has identified a campaign distributing an archive that bundles the legitimate Notepad++ text editor alongside LunchPoke, a malicious utility disguised as a plugin that establishes persistence on the infected system. BleepingComputer reported July 23, 2026.
The archive delivers a working copy of Notepad++. That’s the cover. LunchPoke installs into the plugin directory alongside it and achieves persistence without visibly breaking anything the user relies on. No vulnerability in Notepad++ is being exploited — the plugin architecture is behaving exactly as designed. LunchPoke is abusing it.
What to actually do
This is a distribution vector problem, not a Notepad++ product problem. Audit accordingly:
- Verify installer sources. Notepad++ should come from notepad-plus-plus.org — verify hashes against official release signatures before deployment. Any archive distributed via shared drives, internal file shares, or messaging apps is uncontrolled risk.
- Audit plugin directories. On Windows, check
%AppData%\Notepad++\plugins\and%ProgramFiles%\Notepad++\plugins\. Any DLL or executable that doesn’t match a known, approved plugin is worth investigating. - Pull LunchPoke indicators. CERT-UA’s disclosure, detailed in BleepingComputer’s write-up, contains indicators of compromise for use in endpoint detection queries.
- Review your allowed-software inventory. If Notepad++ isn’t in your approved software catalog, ask why it’s running. Unapproved software with extensible plugin systems is a predictable attack surface.
Priority call
No CVE, no emergency patch cycle. The priority is sourcing discipline: where is Notepad++ coming from in your environment, and who controls that distribution point? If the answer is unclear, that’s the gap.
The logic here isn’t new. GitHub Actions runners were recently compromised via malicious Packagist packages and SleeperGem hid in dormant RubyGems packages — both cases where legitimate ecosystems carried hostile payloads. LunchPoke uses the same logic with a different delivery surface. The application is real, the plugin system is legitimate, only the payload is hostile. Detection requires knowing what’s supposed to be there.
Source
- BleepingComputer, 2026-07-23: Hackers abuse Notepad++ plugins to stealthily install malware
Found this useful? Share it.
