Suspect Notepad++ Malicious Updater Exfiltration via temp.sh

nomit vyas@xoxo

•updated Feb 22, 2026•1•0•72

Detects execution of curl.exe uploading data to temp.sh using custom user-agent parameters, consistent with publicly reported malicious Notepad++ updater activity.