Vendor

Notepad++

2 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 16, 2026 · last 3h ago

Timeline2 articles

PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks

PAPERMILL phishing campaign abuses a signed Notepad++ copy and tax-audit lures to deploy VenomRAT against targets in India.

JUMPSEC tracks PAPERMILL as an emerging cluster whose emails pass SPF, DKIM, and DMARC and deliver tax-audit themed disk images. The mounted image pairs a legitimately signed, renamed executable with a rogue libcurl.dll for DLL sideloading, then uses a Donut shellcode loader to run VenomRAT 6.0.3 in memory with hidden VNC, data-stealing, and file-grabbing capabilities. The loader includes anti-analysis checks and RunOnce persistence, and lures plus China-connected infrastructure overlap with the Silver Fox ecosystem, though attribution remains unconfirmed.

Cyber Security News12:23 UTC · 3h agoPhishing & fraud in the wild 2 sources

PAPERMILL Malware Campaign Abuses Signed Notepad++ to Deliver VenomRAT to Windows Users

JUMPSEC tracks PAPERMILL, a China-nexus phishing campaign using a signed Notepad++ binary, libcurl.dll sideloading, and Donut loaders to deploy VenomRAT against Indian tax-audit targets.

PAPERMILL delivers ISO disk images via tax-audit phishing emails that passed SPF, DKIM, and DMARC, containing a renamed Authenticode-signed Notepad++ executable and a malicious libcurl.dll that proxies curl functions while executing loader logic in DllMain. The chain uses Mark-of-the-Web bypasses, anti-sandbox sleeps, UAC elevation prompts, Registry persistence, and a Donut shellcode loader to reflectively load .NET VenomRAT v6.0.3 with HVNC and credential-stealing capability, with C2 at 154.36.188.201:4449. JUMPSEC assesses the campaign as China-nexus, financially motivated, and Silver Fox-adjacent rather than definitively Silver Fox-operated.

GBHackersupdated 12:23 UTC · 3h agofirst 09:36 UTC · 6h agoMalware in the wild 2 sources

Appears with

malware VenomRAT 2 threat actor PAPERMILL 2 organization GBHackers 1 organization JUMPSEC 1 product Donut 1 product Notepad++ 1 product PyCdlib 1 product VenomRAT 1 product Venom RAT + HVNC + Stealer + Grabber v6.0.3 1 vendor JUMPSEC 1 threat actor Silver Fox 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.