Small numbers of Notepad++ users reporting security woes

Interesting one, has been rumbling for about a week in my circles. I’ve heard from 3 orgs now who’ve had security incidents on boxes with Notepad++ installed, where it appears Notepad++ processes have spawned the initial access. These have resulted in hands on keyboard threat actors. It is unclear exactly what is happening, and this blog is not to blame the (very good) developer of Notepad++. It’s more just to raise awareness. I should also point out it is based on incomplete information, as a full picture