Watering Hole Attack Targets EmEditor Users With Information-Stealing Malware | 趨勢科技

TrendAI™ Research provides a technical analysis of a compromised EmEditor installer used to deliver multistage malware that performs a range of malicious actions.

By: Don Ovid Ladores, Yuya Sato, Yosuke Akiho 2026/01/22 Read time: ( words)

In late December 2025, EmEditor, a highly extensible and widely used text, code, and CSV editor developed by U.S.-based Emurasoft, published a security advisory warning users that its download page had been compromised. The attackers’ objective was to distribute a compromised version of the program to unsuspecting users.

EmEditor has longstanding recognition within Japanese developer communities as a recommended Windows-based editor. This suggests that the attackers are targeting this specific user base, or that they have a particular target among EmEditor users and used the compromised download page as delivery mechanism.

However, the threat actor responsible for this attack has yet to be identified. The timing also suggests that the attackers might have taken advantage of the year-end holiday period, when reduced staffing or more relaxed routines can increase the likelihood of security lapses.

A compromised version of the installer is downloaded from the website of EmEditor. The package (an .MSI file) is modified such that once executed, it will spawn a PowerShell command to retrieve its first-stage code, which is located at a URL (EmEditorjp[.]com) crafted to make it look legitimate.

The first-stage payload then connects to two similar-looking URLs to retrieve two more scripts, which will be its main payload. The PowerShell script is obfuscated using a mix of string manipulation techniques (e.g., Insert, Remove, Replace, Substring, Trim). This is apparent throughout the script and is consistent with its successive payloads. After decryption, the URLs are executed through the Invoke-WebRequest (IWR) method:

The second payload, after proper deobfuscation, is found as its main antisecurity mechanism. It also has other functions:

The other payload is responsible for a different set of functions, mainly the following:

Based on its geofencing behavior, we assess that the threat actors are likely of Russian origin, or those from the Commonwealth of Independent States (CIS). This aligns with a common pattern observed among groups from this region, where “friendly” countries are excluded to reduce legal and operational risk. It excludes:

The malware sends all collected information to its C&C server at:

Another notable detail we saw is the consistent presence of the unique string “ 2daef8cd ” on its communication, suggesting that it may likely resemble some sort of Campaign ID.

As of now, there are already a few recorded instances of the URL being accessed by EmEditor users, suggesting that some have already been likely compromised prior to the company’s announcement.

This incident challenges longstanding assumptions that trusted software can be treated as lower priority during triage, and that installations — even from official vendors — is inherently less risky than exploit-driven intrusion. The following best practices can help organizations strengthen their ability to detect and contain this kind of threat:

For developers and software publishers, this kind of attack shows that protecting how software is built and delivered is just as important as securing the application itself:

TrendAI Vision One™ is the industry-leading AI cybersecurity platform that centralizes cyber risk exposure management, security operations, and robust layered protection.

TrendAI Vision One™ Threat Intelligence Hub provides the latest insights on emerging threats and threat actors, exclusive strategic reports from TrendAI™ Research, and TrendAI Vision One™ Threat Intelligence Feed in the TrendAI Vision One™ platform.

Emerging Threats: Watering Hole Attack Targets EmEditor Users With Information-Stealing Malware

Watering Hole Attack Targets EmEditor Users With Information-Stealing Malware

TrendAI Vision One™ customers can use the App to match or hunt the malicious indicators mentioned in this blog post with data in their environment.

EMEDITOR Command Lines:

processCmd:(powershell AND (emeditorjp.com OR emeditorgb.com/run/mg8heP0r OR emeditorde.com/gate/start/2daef8cd OR cachingdrive.com/gate/init/2daef8cd))

More hunting queries are available for TrendAI Vision One™ with Threat Intelligence Hub entitlement enabled.

The indicators of compromise for this entry can be found here .