Vidar: Fake Notepad++ Malvertising to Data Theft

An endpoint risk alert fired on a developer workstation at Helionova Interactive this morning: a process spawned from a freshly downloaded installer started reading browser credential stores and reaching out to the internet. The user thought they were installing a common code editor. Get oriented before you pivot: read the alert context, then work the proxy, endpoint, and perimeter data in order. The questions that follow walk the chain from how the file arrived to where the stolen data went.

The download did not start at the software vendor's real site. It started at a page the user reached through a search advertisement, a lookalike of the editor's download portal. Recover the domain of that landing page.

The landing page did not serve the file itself. It redirected the browser to a second host that handed over the installer. That host is not a software vendor's content network. Recover the domain that served the download.

The file the user ran looked like an ordinary installer and was padded to roughly the size of the real one. To track it across the fleet and on intelligence sources, you need a content fingerprint, not just a filename. Recover the SHA-256 of the downloaded installer.

For the report, classify how the attacker first got code in front of the user. The compromise did not start with an email or an exploit of a service: it started with a paid search advertisement that routed the user to attacker-controlled content. Map that initial-access method to its MITRE ATT&CK technique.

After it ran, the stealer did not carry its command-and-control address inside the binary. It looked the address up from a configuration string parked on a couple of legitimate public profile pages, then connected out to take orders, pull modules, and ship the stolen data. Identify the external address you would block to sever that channel.