Legitimate Binaries Executed from AppData (Notepad++ Supply Chain Attack)

Ethan Andrews@eandrews

•updated Mar 2, 2026•14•1•168

Detects legitimate executables, known to be abused in the Notepad++ supply chain attack, running from user AppData directories. This behavior is highly indicative of DLL side-loading.