Hackers abuse Notepad++ plugins to stealthily install malware

CERT-UA reported a targeted campaign by UAC-0099 (linked to APT44/Sandworm) that distributes a ZIP containing a VBS-disguised PDF which ultimately installs a trojanized Notepad++ with a malicious plugin (LunchPoke) that creates scheduled tasks and deploys a loader (BurnyBear/MatchBoil v2); the report describes the multi-stage delivery and persistence chain, mentions a disputed DLL-hijacking CVE for Notepad++ 8.8.3, and recommends updating Notepad++, 7-Zip, and WinRAR.