Ukrainian Cyber Agency Warns of MATCHBOIL.V2 Malware Distributed via Fake Notepad++ Add-ons

A major warning has been issued by the Computer Emergency Response Team of Ukraine (CERT-UA) regarding a fresh wave of cyberattacks aimed at Windows-based computers. According to the agency, threat actors are leveraging a malicious tool masked as an add-on for Notepad++ to infect devices and deploy a highly advanced malware variant known as MATCHBOIL.V2.

CERT-UA explains that the fraudulent plugin is designed to mimic authentic software, capitalizing on the confidence users have in well-known extensions. When run on a Windows machine, the fake component silently loads the MATCHBOIL.V2 malware, allowing attackers to secure access for future malicious operations.

The national cybersecurity incident response body has linked this malicious activity to a tracked threat cluster designated as UAC-0099. This connection shows that the current wave of attacks is part of a continuous, monitored operation run by an established hacking group.

This intrusion vector is especially worrisome because it targets highly popular software. Notepad++, an open-source text and source code editor widely utilized by developers and everyday users, features a plugin network that serves as an appealing target for cybercriminals looking to spread malware quietly and on a large scale.

The campaign highlights an ongoing struggle in the cybersecurity field: the deployment of supply chain manipulation and social engineering to slip past standard security measures. By pretending to be a helpful, reliable tool, attackers greatly boost their likelihood of breaching networks and dodging early detection.

For businesses and individuals using Windows who regularly install third-party add-ons, this alert emphasizes the need for extreme caution. A key security habit remains confirming the legitimacy of any downloaded software or plugins by obtaining them solely from verified, official channels.

Continuous observation and quick warnings from organizations like CERT-UA are vital in countering modern digital threats. By keeping tabs on specific groups like UAC-0099, they supply critical data that helps block large-scale infections and safeguard essential digital systems against complex cyberattacks.