Infostealer Malware Delivered in EmEditor Supply Chain Attack

Infostealer malware was delivered through a supply chain attack against EmEditor, with the malicious installer served via the official download button. The software’s developers warned that users who downloaded EmEditor using the Download Now button between 19 December 2025, 18:39 PT, and 22 December 2025, 12:50 PT may have received a file lacking the digital signature.

Based on Emurasoft’s analysis, the URL behind the button pointed to a malicious .msi file hosted on a different location on the EmEditor site, signed with a certificate from a different company, and the installer then executed a PowerShell command to fetch and run a file from a fake EmEditor domain.

The malware collected system information and files from Desktop, Documents and Downloads, including VPN configurations, browser information, and credentials for multiple apps, before deploying a browser extension named Google Drive Caching for persistence and extra data exfiltration, including keystrokes, cookies, bookmarks and browser history.

According to Qianxin, the threat actor appears to be profit-driven rather than state-sponsored, and the campaign targeted users with a significant China-based user base, though attribution has not been disclosed by them. The incident highlights how third-party risk can enable information-stealing activities across extensive user environments.