NPP brand impersonation website serving malware

notepad-plus-plus [dot] app is a brand impersonation website that copied your site but is serving rotating malware droppers. They also did this to my application, Wisecard 365, and probably other applications.

Infrastructure and methods includes:

• ficoso [dot] click
• frapdownload [dot] org
• EtherHiding
• unique URLs per victim
• detection of Node.js to avoid analysis
• file downloads larger than many scanners allow

While the malicious websites are good clones, the downloads they server don't resemble the real apps at all: different filenames, different contents.

You might want to start by reporting notepad-plus-plus [dot] app and ficoso [dot] click for abuse to:

• Cloudflare
• registrar
• Google Safe Browsing

You could also monitor for brand impersonation like this and other ways.

Some references

• notepad-plus-plus dot app (urlscan.io)
• domain:"ficoso.click" (urlscan.io)

This issue is just an FYI: feel free to close this ticket whenever you like.

I've also seen dozens of organizations on GitHub impersonating my app, plus easily 100 other organizations impersonating other apps, and my guess is there are/have been thousands. These all seem to be AI-generated variations created by the same person/group. GitHub doesn't seem to want to find them, and GH makes it difficult for me to report them by rate limiting reports to something like four reports. GH has taken weeks to take them down, too.

No repository file, test, or entry point is identified. Start by reviewing the reported URLs and abuse details, then determine whether the project has an established security-reporting or brand-abuse process; done would require a maintainer decision on appropriate action rather than a repository change.