Proxyware Malware Disguised as Notepad++ Tool Leverages Windows Explorer Process to Hijack Systems

A malicious campaign attributed to Larva-25012 distributes proxyware hidden inside fake Notepad++ installers (MSI and ZIP) on fraudulent download portals, primarily targeting users in South Korea; the malware uses DLL side-loading, process injection, Task Scheduler persistence, and installs Infatica/DigitalPulse proxy modules to hijack victims' network bandwidth for profit.