When a Text Editor Turns Into a Loader: The Notepad++ Plugin Trap

Fast Facts

• The activity is tied to UAC-0099, a tracked threat cluster.
• The reported delivery method uses Notepad++ and a DLL posing as a plugin.
• The campaign has been observed since mid-summer 2026.
• LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2 are named as part of the tooling set.
• The full trigger path, scope, and downstream impact remain unconfirmed in public technical detail.

Why this technique works

Notepad++ plugins are DLL-based extensions, so the application expects to load library files as part of its normal workflow. That creates a defensive blind spot: if a hostile DLL is placed on a path the program will trust, it may be loaded as if it were a legitimate add-on. In Windows terms, this fits the broader DLL side-loading and hijack pattern, where code runs inside a legitimate process instead of standing out as a separate suspicious executable.

That does not prove a flaw in Notepad++ itself. The article describes abuse of the plugin-loading model, not a confirmed software vulnerability. The practical risk is that a trusted host can become the wrapper for untrusted code, especially if a user installs extensions from outside the normal update channel or if a malicious file lands where the application searches for modules.

What the new names suggest

The appearance of LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2 suggests tool and delivery-method changes within an already tracked cluster, but their exact roles are not established here. From a defensive perspective, that uncertainty is itself useful: when a group keeps changing loaders and packaging, defenders should focus less on a single malware name and more on the underlying load path, file origin, and process behavior.

That means watching for unexpected DLLs in plugin directories, unsigned or unfamiliar extensions, and editor processes that suddenly load modules from user-writable locations. For background, Notepad++’s Plugin Admin uses a signed plugin list, which helps reduce tampering risk. But integrity checks on the catalog do not eliminate the need to inspect the binaries that actually get loaded on endpoints.

Windows module-loading behavior also matters. Microsoft’s guidance makes clear that loading by name rather than by fully qualified path can create room for malicious libraries to be picked up from searched directories. In practice, that turns a convenience feature into an execution surface.

At the time of writing, public information has not fully established the technical root cause, the complete scope of affected users, or whether downstream systems were compromised. The available evidence supports a risk analysis, not a definitive attribution of negligence or full compromise.

Conclusion

The broader lesson is simple: any plugin ecosystem is a trust boundary. Once a hostile DLL can pass as an expected extension, the attacker no longer needs to fight the application - they only need to blend into its normal behavior. That is why plugin hygiene, module-path discipline, and least-privilege controls matter just as much as malware detection.

WIKICROOK

• DLL side-loading: A technique where a legitimate application loads a malicious library because the file matches what the program expects.
• Plugin Admin: Notepad++'s built-in plugin manager, used to install and update extensions.
• Loader: A component that prepares or launches other malware stages.
• Trust boundary: The line between trusted software behavior and untrusted input or files.
• Unsigned DLL: A library without a trusted digital signature, which can be a warning sign in plugin-heavy environments.