Notepad++ Plugin DLL Swap (CVE-2025-56383) — User-Writable + Recent Change/Rename + Load

Dirty Wizard@DirtyWizard404

•updated Oct 2, 2025•7•2•222

Detects probable exploitation of the reported Notepad++ plugin DLL hijack by correlating DLL loads from Notepad++\plugins with recent file changes or swap-style renames, prioritising user-writable locations (Users/AppData/OneDrive) and weak trust. Outputs a Verdict and SuspicionScore for quick triage.