There are countless security vulnerabilities and trust in software distribution is one of them. Users install applications from official vendor websites, enterprise controls allowlist signed software, and automated update mechanisms routinely pull code from trusted infrastructure. This post takes you through a supply-chain compromise targeting the EmEditor software distribution channel, where attackers weaponized a trusted WordPress-based download infrastructure to selectively deliver a trojanized MSI installer. It demonstrates how conditional server-side logic, installer abuse, and living-off-the-land techniques can bypass traditional defenses and enable credential theft at scale. It includes how the malicious installer behaved, and how defenders can detect and mitigate similar threats.
Attackers compromised the upstream distribution mechanism for EmEditor, a widely used Windows text editor. Instead of delivering malware through phishing or malicious domains, the attackers manipulat...
Updated Mar 06, 2026
Version 1.0
Parth_Jamodkar
Microsoft
Microsoft