PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks
PAPERMILL phishing campaign abuses a signed Notepad++ copy and tax-audit lures to deploy VenomRAT against targets in India.
55
Vendor
Notepad++
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 16, 2026
- Last mentionedSep 16, 2026
Timeline
2 articles · newest firstPAPERMILL Malware Campaign Abuses Signed Notepad++ to Deliver VenomRAT to Windows Users
JUMPSEC tracks PAPERMILL, a China-nexus phishing campaign using a signed Notepad++ binary, libcurl.dll sideloading, and Donut loaders to deploy VenomRAT against Indian tax-audit targets.
55
Appears with
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.