Open source text editor poisoned with malware to target Uyghur users

Citizen Lab identified a targeted phishing and supply-chain campaign aimed at Uyghur diaspora members and World Uyghur Congress affiliates: attackers sent spoofed emails with Google Drive links to a password-protected RAR that contained a trojanized Windows build of the UyghurEditPP text editor. The altered application included a backdoor enabling information collection, file exfiltration, and downloading/installing additional malware plugins; the attack relied on high-quality social engineering and likely leveraged trust relationships within the community. Researchers did not attribute a specific actor but noted parallels to prior China-linked tactics; the campaign showed no zero-day exploitation and had limited technical sophistication, and affected recipients were alerted by Google and not widely deceived.