Fake Notepad++ Plugin Delivers MATCHBOIL.V2 Malware in Ukraine-Linked Campaign

Ukraine's Computer Emergency Response Team (CERT-UA) has issued a warning about a new malware campaign attributed to the Russia-aligned threat group UAC-0099. As reported by The Hacker News on July 24, 2026, attackers are distributing a malicious program disguised as a legitimate Notepad++ plugin to gain access to Windows systems.

What Happened

UAC-0099 is distributing a piece of malware called MATCHBOIL.V2, packaged to look like a Notepad++ plugin. Notepad++ is a widely used free text editor for Windows, and its plugin ecosystem is popular with developers and technical users. By masquerading as a plugin, the malware attempts to appear trustworthy and bypass a victim's initial suspicion.

CERT-UA attributes this campaign to UAC-0099, a group with a documented history of targeting Ukrainian organizations. The group has previously exploited vulnerabilities in WinRAR, another popular Windows utility, to deliver malicious payloads. The shift to fake plugins reflects a broader trend: attackers targeting the tools developers already trust and use every day.

Why This Matters to Small Teams

Solo developers and small teams often download utilities, plugins, and extensions from forums, GitHub comments, or third-party aggregator sites. This workflow is fast and practical, but it creates real risk. A fake plugin that mimics a well-known tool like Notepad++ is exactly the kind of threat that bypasses technical users who assume they know what they are installing.

Developer workstations are high-value targets. They typically hold source code, API keys, cloud credentials, SSH keys, and access to production systems. A single compromised developer machine can give an attacker a path to your entire infrastructure - not just the local device. Even if your business has nothing to do with Ukraine or geopolitics, malware campaigns routinely spread beyond their original targets once infrastructure is in place.

The use of UAC (User Account Control) bypass techniques, hinted at in the campaign name UAC-0099 and the malware's behavior, means the attacker aims to escalate privileges quietly. If a developer installs what they believe is a plugin and clicks through a UAC prompt out of habit, the malware can gain elevated access with minimal friction. Developers who work fast and trust prompts by default are exactly the profile this type of attack is designed to exploit.

How to Stay Protected

1. Only install Notepad++ plugins from the official Plugin Admin interface. The built-in Plugin Admin fetches plugins from the verified Notepad++ plugin list. Avoid downloading DLL files from forums, GitHub issues, or third-party sites and dropping them into the plugin folder manually.

2. Verify file sources before running anything. If you must download a file from outside an official channel, check the publisher's digital signature. Right-click the file in Windows Explorer, select Properties, and check the Digital Signatures tab. An unsigned plugin claiming to be from a known project is a red flag.

3. Keep Windows UAC at its default level or higher. Do not disable UAC on your development machine. Treat unexpected UAC prompts as suspicious, especially when triggered by plugins or utilities you just downloaded.

4. Use endpoint detection on developer machines. Windows Defender is free, always-on, and catches many known malware families. Make sure it is enabled and up to date. Consider a second-opinion scanner if you regularly handle sensitive credentials or production access.

5. Store credentials outside your local filesystem when possible. Use a password manager and a secrets manager (such as AWS Secrets Manager, 1Password Secrets Automation, or Doppler) rather than storing API keys and SSH keys in plaintext files on your workstation. This limits the damage if a machine is compromised.

6. Follow threat intelligence sources relevant to your region and sector. CERT-UA publishes advisories publicly. If your clients or infrastructure touch European or government sectors, subscribing to these feeds gives you early warning of active campaigns.

How UNPWNED Helps

UNPWNED focuses on web-facing security: scanning your public site and application for misconfigured headers, exposed sensitive files, outdated software versions, and missing security controls. This particular campaign targets developer workstations rather than web infrastructure directly, so our scanner does not detect malware on your local machine. However, if a compromised developer machine leads to leaked credentials or misconfigured server settings being pushed to your live site, UNPWNED can surface those web-layer exposures - such as publicly accessible sensitive files or missing security headers - before attackers find them.

---

This post was drafted with AI assistance based on authoritative security sources, then published under editorial review.