Notepad++ · Exploitation confirmed

Notepad++ package carries malicious NppExport.dll, comment flags Outflank C2

Nov 05, 2026 · 1 min read

A Notepad++ archive distributed from npparchive.z1.web.core.windows.net contains a malicious NppExport.dll plugin, flagged in VirusTotal samples by malwrhunterteam. A comment on the platform points to the Outflank C2 and calls it likely pentester activity. No fix is mentioned; download the editor only from the official website and verify installer origins.

By HIFY Radar newsroom Updated 11/05/2026 10:07 AM Get this every day →← Back to the feed 1 source

HighSupply chainExploitation confirmedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A Notepad++ archive hosted outside the official channel carries a malicious NppExport.dll plugin, identified in VirusTotal samples. A comment on the platform indicates communication with the Outflank command-and-control server and calls it likely pentester activity. The disclosure comes from malwrhunterteam.

Why it matters

Anyone who installed the editor from this source may have run malicious code that communicates with an external server, exposing data and machine control. Notepad++ is widely used by engineering and development teams.

What to do

Download Notepad++ only from the official website and review the origin of installers in use. Investigate machines that received packages from npparchive.z1.web.core.windows.net and look for the suspicious NppExport.dll file.

For the technical team

Affected: Notepad++ (software representado) Pacote do Notepad++ distribuído a partir de npparchive.z1.web.core.windows.net, contendo o plugin NppExport.dll malicios · Notepad++ package hosted at npparchive.z1.web.core.windows.net; versions not stated in the sources.
Exploitation: Malicious sample flagged on VirusTotal by malwrhunterteam. A user comment on VT indicates communication with the Outflank C2 and assesses it as likely pentester activity. No victims or exploitation in production reported in the sources.
Fix: Fix unconfirmed
Vector: Notepad++ archive distributed from npparchive.z1.web.core.windows.net containing the malicious NppExport.dll plugin. Exploitation requires the user to download and run the package from this unofficial source.
More details: Disclosed by the @malwrhunterteam account on X. The Outflank C2 attribution and the pentest assessment come from a comment on VirusTotal, not from a vendor analysis. The hosting origin of the archive was not determined in the sources.