Masquerading Notepad++ AutoUpdater Execution

J S@jsh0x

•updated Feb 2, 2026•31•1•22,242

Detects the execution of 'AutoUpdater.exe' or 'update.exe' with the '/closeRunningNpp' flag. This specific behavior has been observed in hijacked Notepad++ update flows where a malicious binary masquerades as the legitimate updater. 'AutoUpdater.exe' is not a legitimate Notepad++ file.