Bandwidth Bandits: Fake Notepad++ Installers Hide “Proxyjacking” Malware

ASEC (AhnLab) warns of a Larva-25012 campaign distributing trojanized Notepad++ installers (Setup.zip containing Setup.exe and malicious TextShaping.dll) that use DLL side-loading to deploy DPLoader and proxyware (Infatica, DigitalPulse). The threat persists via scheduled tasks (including a task masquerading as "Microsoft Anti-Malware Tool"), tampers with Windows Defender settings to evade detection, and monetizes victims' internet connections through Proxyjacking.