Notepadplusplus Supply Chain Exfil In User Agent

nomit vyas@xoxo

•updated Feb 9, 2026•1•0•83

Detects an unusual exfiltration technique where a URL, typically from temp.sh, is embedded within the User-Agent string of an HTTP request. This TTP was observed in the Notepad++ supply chain attack in 2025 for exfiltrating system information.