BLUF

Attackers compromised the official download page of EmEditor, a popular text editor for developers, to distribute a tampered installer that delivers a multi-stage PowerShell-based stealer.

Executive Cost Summary

This cost analysis was developed by the CyberDax team using expert judgment and assisted analytical tools to support clarity and consistency.

For organizations affected by a watering hole supply-chain compromise delivering credential-stealing malware through a trusted developer tool:

• Low-end total cost: $750,000 – $1.2M
• (Limited endpoint exposure, rapid detection, minimal credential reuse)
• Typical expected range: $1.5M – $3.5M
• (Multiple developers impacted, credential resets, short-term operational disruption)
• Upper-bound realistic scenarios: $4M – $7M
• (Credential abuse leads to secondary access, customer assurance actions required)

Key Cost Drivers

• Number of developer endpoints requiring rebuild and credential resets
• Evidence of credential reuse across internal or customer-facing systems
• Duration between installer exposure and detection
• Contractual security obligations to enterprise customers
• Cyber insurance deductible levels and coverage limitations

Targeted Sectors

• Software Development
• IT
• Technology

Countries Targeted

• Global

Date of First Reported Activity

• Late December 2025

Date of Last Reported Activity Update

• January 26, 2026

APT Names

• Unidentified (suspected Russian or CIS-based due to geofencing).

Associated Criminal Organizations

• No criminal organization has been associated with this at this time.

IOCs

Domain

• EmEditorjp[.]com (malicious C2 mimicking legitimate site).

Installer

Tampered MSI installer for EmEditor.

Related Persistence Mechanisms

Scheduled Task

• A task named Google Drive Caching may be present in the system.

VBScript File

• A file named background.vbs is typically created in %LOCALAPPDATA%\Google Drive Caching\.

Log File

• The presence of C:\ProgramData\tmp_mojo.log is a known indicator of infection.

Command and Control (C2)

• The malware communicates with malicious domains, most notably cachingdrive[.]com

Tools Used

• PowerShell
• MSI Installers

CVEs & CVSS

• No specific CVE assigned to the watering hole site breach yet
• it involves a compromise of the vendor's distribution infrastructure.

Nessus ID

• Not applicable at this time.

Mitigation

• Verify checksums of downloaded installers. Emurasoft has issued a security advisory on its official site.

Malware Names

• Evelyn Stealer
• "Google Drive Caching" Extension

o   As part of the infection chain, the malware may deploy a malicious browser extension by this name. This extension serves as a fully featured infostealer itself, capable of:

§  Logging keystrokes and stealing cookies.

§  Collecting browser history and bookmarks.

§  Replacing cryptocurrency wallet addresses with those controlled by the attacker.

§  Stealing Facebook ad accounts.

• Obfuscated PowerShell Scripts

o   The initial compromise involves a modified Microsoft Installer (.MSI) that executes heavily obfuscated PowerShell scripts to download and deploy the final payloads.

Malware Sample

sha256

E3544F1A9707EC1CE083AFE0AE64F2EDE38A7D53FC6F98AAB917CA049BC63E69

Known Decoding Key (AES-256-CBC)

Key (32 bytes)

2e649f6145f55988b920ff5a445e63aae29c80495b830e0d8bb4b3fff4b1f6f4

IV (16 bytes)

5c507b22e9814428c5f2b1ef213c5c4a

Verdict

• Malicious

o   Categorized as a high-risk data exfiltration Trojan.

Primary Objectives

• Harvest browser credentials, cookies, and autofill data.
• Steal cryptocurrency wallet information and session tokens.
• Capture system metadata, clipboard contents, and Wi-Fi credentials.
• Take screenshots of the infected environment.

Threat Actor Context

• Observed targeting software developers by abusing the Visual Studio Code (VSC) Extension Marketplace.
• Uses lures like "Bitcoin Black" themes and "Codo AI" coding assistants to deliver malicious extensions.
• Functions as a mature multi-stage pipeline designed to pivot from developer workstations into enterprise environments.

Behavior Analysis

Initial Infection

• Chained through malicious VSC extensions that execute PowerShell and batch scripts upon activation.

Anti-Analysis

• Implements multiple checks to detect sandbox or research environments and terminates if identified.

Execution

• Employs Process Hollowing and DLL Hijacking (often using the legitimate Lightshot utility) to run malicious code under trusted binary names like grpconv.exe.

Exfiltration

Communicates with Command-and-Control (C2) servers over FTP for data upload.

TTPs

Initial Access

• T1195.002 Supply Chain Compromise

o   Compromise Software Supply Chain: Attackers modified the legitimate EmEditor MSI installer on the official website to include a malicious CustomAction script.

• T1189 Drive-by Compromise

o   The compromise of the official download page served as a "watering hole" to infect users visiting the site.

Execution

• T1059.001 Command and Scripting Interpreter PowerShell

o   The modified installer executes a PowerShell command to download and run subsequent payloads.

• T1204.002 User Execution Malicious File

o   Execution occurs when a user runs the trojanized version of the installer.

Persistence & Evasion

• T1027 Obfuscated Files or Information

o   Payloads use complex string manipulation (Insert, Remove, Replace) to evade signature-based detection.

• T1562.001 Impair Defenses: Disable or Modify Tools

o   The malware specifically disables PowerShell Event Tracing for Windows (ETW) to suppress security logging.

• T1497.001 Virtualization/Sandbox Evasion System Checks

o   The malware performs anti-virtualization checks and process detection to identify security software.

• T1614.001 System Location Discovery

o   System Language Discovery (Geofencing): The attack employs geofencing to restrict execution based on geographic regions (e.g., excluding certain CIS countries).

Credential Access & Collection

• T1555.004 Credentials from Password Stores

o   Windows Credential Manager: The primary payload extracts stored credentials from the Windows Credential Manager.

• T1113 Screen Capture

o   The malware is capable of taking screenshots of the victim's system for reconnaissance.

• T1082 System Information Discovery

o   The malware harvests detailed system information and fingerprints the infected machine.

Command and Control

• T1071.001 Application Layer Protocol Web Protocols

o   Communication with the command-and-control (C2) server is conducted via HTTPS.

• T1105 Remote File Copy

o   PowerShell's Invoke-WebRequest (IWR) is used to retrieve additional stages of the malware.

Suggested rules / potential hunts

As a reminder, these are indicator rules. They are likely to be noisy.

For best results consider creating a data model and reviewing the traffic as a report.

Suricata

Create alerts for the known malicious domains used to stage payloads.

alert dns $HOME_NET any -> any any (msg:"ET HUNTING EmEditor Watering Hole Domain (emeditorjp[.]com)"; dns.query; content:"emeditorjp.com"; nocase; sid:2026001; rev:1;)

alert dns $HOME_NET any -> any any (msg:"ET HUNTING EmEditor Watering Hole Domain (emeditorgb[.]com)"; dns.query; content:"emeditorgb.com"; nocase; sid:2026002; rev:1;)

alert dns $HOME_NET any -> any any (msg:"ET HUNTING EmEditor Watering Hole Domain (emeditorde[.]com)"; dns.query; content:"emeditorde.com"; nocase; sid:2026003; rev:1;)

Alert on specific URI patterns used for credential theft and system info gathering.

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET TROJAN Evelyn Stealer Payload Request (/run/mg8heP0r)"; http.uri; content:"/run/mg8heP0r"; sid:2026004; rev:1;)

SentinelOne

Search for msiexec.exe spawning PowerShell with unusual arguments or network connections.

ProcessName = "msiexec.exe" AND ChildProcessName = "powershell.exe"

ProcessName = "msiexec.exe" AND DNSRequest CONTAINS "EmEditor" (to find spoofed domains)

Identify obfuscated PowerShell or use of Invoke-WebRequest (IWR) to suspicious domains.

ProcessName = "powershell.exe" AND (CommandLine CONTAINS ".Insert" OR CommandLine CONTAINS ".Substring")

DNSRequest IN ("EmEditorjp.com", "EmEditorgb.com", "EmEditorde.com", "cachingdrive.com")

Monitor for registry or process modifications intended to disable ETW

ProcessName = "powershell.exe" AND (CommandLine CONTAINS "ETW" AND CommandLine CONTAINS "Disable")

Detect unauthorized access to credential storage or sensitive registry keys.

ProcessName = "powershell.exe" AND RegistryKeyPath CONTAINS "Credentials"

Splunk

Look for common string manipulation techniques (e.g., Insert, Remove, Replace) in PowerShell logs (Event ID 4104).

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational"

| eval script_len=len(ScriptBlockText)

| where script_len > 500 AND (match(ScriptBlockText, "Replace|Insert|Remove|Substring|Trim"))

| stats count by ComputerName, ScriptBlockText

Domain Typosquatting Check

Compare web proxy or DNS logs against the legitimate emeditor.com domain.

index=network sourcetype=dns query="emeditor*" NOT query="emeditor.com"

| stats count by query, src_ip

Delivery Method

• Tampered installer hosted on the official download page

Email sample

References

CyberPress

• hxxps://cyberpress.org/emeditor-watering-hole-stealer-attack/

Trend Micro

• hxxps://www.trendmicro.com/en_us/research/26/a/watering-hole-attack-targets-emeditor-users.html
• hxxps://www.trendmicro.com/en_us/research/26/a/analysis-of-the-evelyn-stealer-campaign.html

VirusTotal

• hxxps://www.virustotal.com/gui/file/e3544f1a9707ec1ce083afe0ae64f2ede38a7d53fc6f98aab917ca049bc63e69/details