Notepad++ Attack Chain Staging Artifacts

Aaron Beardslee@abeardslee

•updated Feb 4, 2026•9•0•150

Detects the creation of specific files in AppData paths associated with the second and third infection chains of the Notepad++ supply chain attack. These files are related to Lua script execution and DLL sideloading for persistence and execution.