Bandwidth Bandits: Fake Notepad++ Installers Hide “Proxyjacking” Malware

According to AhnLab Security Intelligence Center (ASEC), a new wave of attacks targets users seeking free software, with the threat actor Larva-25012 allegedly distributing malware masquerading as Notepad++. The campaign is described as a Proxyjacking operation, where attackers install software to siphon a victim’s internet bandwidth for profit.

Victims are lured to fake websites that resemble download pages for cracked software, and the bundled Setup[.]zip contains both the legitimate Notepad++ installer and a malicious loader DLL named TextShaping.dll. The malware uses DLL side-loading to run the malicious payload when the genuine Notepad++ installer is launched, eventually installing DPLoader, a downloader that operates via a Windows Task Scheduler entry to persist and contact its C&C server.

To avoid detection, the attackers reportedly modify Windows Defender policies and sometimes inject Proxyware into system processes or employ Python-based loaders. The result is Proxyware such as Infatica and DigitalPulse, with Infatica registered as a scheduled task named “Microsoft Anti-Malware Tool” to appear legitimate.