A sophisticated watering hole attack targeting EmEditor users, a popular Windows text editor favored by developers, especially in Japan.
In late December 2025, attackers compromised EmEditor’s download page to distribute a tampered MSI installer.
This supply chain attack delivers multistage PowerShell-based stealer malware that steals credentials, exfiltrates data, and enables lateral movement.
The malware evades detection by deferring malicious actions post-installation, allowing prolonged dwell time.
EmEditor, developed by U.S.-based Emurasoft, issued a security advisory on its site warning users. The attack likely exploited year-end holidays for reduced vigilance.
While the threat actor remains unidentified, geofencing in the malware excludes CIS countries like Russia, Armenia, Belarus, Georgia, Kazakhstan, and Kyrgyzstan suggesting Russian or CIS origins to minimize risks.
Technical Breakdown and IOCs
The compromised MSI installer spawns a PowerShell command fetching first-stage code from hxxps://EmEditorjp[.]com, mimicking legitimacy.
This stage deobfuscates via string manipulations (Insert, Remove, Replace, Substring, Trim) and invokes two payloads using Invoke-WebRequest:
- hxxps://EmEditorgb[.]com/run/mg8heP0r: Handles credential theft from Credential Manager, disables Event Tracing for Windows (ETW), detects security processes, blocks virtualization, and captures screenshots.
- hxxps://EmEditorde[.]com/gate/start/2daef8cd: Performs system fingerprinting, geofencing checks, registry scans for security apps, and C&C communication.
The “2daef8cd” string appears consistently, likely a campaign ID. Data exfiltrates to hxxps://cachingdrive[.]com/gate/init/2daef8cd. Obfuscation and anti-analysis tactics like ETW disablement help bypass endpoint detection.
Key IOCs:
| Indicator Type | Value |
|---|---|
| Compromised Domains | EmEditorjp[.]com EmEditorgb[.]com EmEditorde[.]com cachingdrive[.]com |
| Payload URLs | hxxps://EmEditorgb[.]com/run/mg8heP0r hxxps://EmEditorde[.]com/gate/start/2daef8cd hxxps://cachingdrive[.]com/gate/init/2daef8cd |
| Campaign ID | 2daef8cd |
| Excluded Countries (Geofencing) | Armenia, Belarus, Georgia, Kazakhstan, Kyrgyzstan, Russia |
TrendAI Vision One blocks these IOCs and offers hunting queries for customers.
Organizations face risks from third-party Windows software via public downloads. CISOs must monitor trusted installers and developer tools rigorously.
Validate MSI integrity with digital signatures and hashes before running.
Govern PowerShell: log executions, block obfuscated scripts, and watch network calls.
For vendors like EmEditor: Secure download servers with access controls and change monitoring. Publish hashes for user verification.
Maintain incident response plans covering takedowns, notifications, and vendor coordination. This attack shatters trust in official installers, urging proactive defenses against supply chain threats.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
