no offense taken, we're all just trying to figure out what's going on 😁 I agree with your observation of Kevin's article though.

Perhaps, this seems like a great write-up of what most recently transpired rapid7.com/blog/post/tr-chry…

@cyb3rops if you've got thoughts about IOCs I'd love to hear them, feel free to DM me if you want someone to try some stuff with a population of various version of notepad++ installed.

Seems like what Kevin describes was aitm interception of update traffic to insert a fake update, whereas the announcement from notepad++ today is about their actual update server being compromised.

I can't wait to see all the phishing emails that'll not only link to cloudflare, but now will originate from it! 😅 blog.cloudflare.com/email-se…

Definitely @Amica for insurance