EmEditor Compromised: “WALSHAM” Imposter Poisons Official Installer with Spyware

According to RedDrip Team, EmEditor’s official download channels were compromised in a supply chain incident that occurred between 19 and 22 December 2025, with the official announcement released on 23 December. The attackers redirected the “Download Now” button to a malicious MSI installer, whose digital signature bore the non-official name “WALSHAM INVESTMENTS LIMITED” rather than Emurasoft, Inc.

The embedded malware functioned as an information-stealer, launching a PowerShell sequence to collect system information and generate an RSA key to encrypt stolen data. The theft targeted VPN configurations, browser data from Chrome, Edge, Brave and Opera, and credentials or data from applications such as Zoho Mail, Evernote, Discord, Slack, Zoom, WinSCP and PuTTY, in addition to exfiltrating files from Desktop, Documents and Downloads folders.

A notable persistence mechanism was the installation of a browser extension called “Google Drive Caching” (ID: ngahobakhbdpmokneiohlfofdmgpakd) to maintain access, which RedDrip Team describes as a fully-featured information-stealing malware. The report also notes a do-not-infect list that terminates execution if the system language matches locales associated with former Soviet states or Iran.