Notepad++ Update Mechanism Compromised by State-Sponsored Attackers

In December 2025, Notepad++ disclosed a significant security breach involving its update mechanism, attributed to state-sponsored attackers, likely linked to China. The breach was characterized by the hijacking of the update traffic intended for the official Notepad++ website, not through vulnerabilities in the software itself, but via a compromised shared hosting server. This incident highlights the vulnerabilities present at the hosting provider level, which allowed attackers to redirect users to malicious servers.

Nation-State Hackers Hijacked Notepad++ Updates via Hosting Infrastructure ExploitNation-state hack exploited hosting infrastructure to hijack Notepad++ updatesNotepad++ Supply Chain Hack Conducted by China via Hosting ProviderNotepad++ Official Update Mechanism Hijacked to Deliver Malware to Select UsersNotepad++ Update Hijacking Linked to Hosting Provider CompromiseNotepad++ Secures Update Chain Post Targeted BreachHow state-sponsored attackers hijacked Notepad++ updates

• June 2025: Attackers began exploiting the Notepad++ update mechanism.

Notepad++ patches update chain after targeted compromise

• September 2, 2025: The compromised hosting server was updated, terminating direct access for attackers.

Nation-state hack exploited hosting infrastructure to hijack Notepad++ updates

• December 2, 2025: Attackers maintained access to internal services, allowing continued redirection of update traffic until this date.

Nation-state hack exploited hosting infrastructure to hijack Notepad++ updates

• December 9, 2025: Notepad++ released version 8.8.9, which included enhanced verification features for downloaded installers.

Notepad++ patches update chain after targeted compromise

• December 27, 2025: Version 8.9 was launched, discontinuing the use of a self-signed certificate for signing release binaries.

Notepad++ patches update chain after targeted compromise

The attackers exploited weaknesses in the Notepad++ updater, known as WinGUP, which prior to version 8.8.8 lacked sufficient integrity verification controls. This allowed them to intercept and redirect update traffic, serving malicious updates to targeted users, particularly those in telecommunications and financial sectors in East Asia. Security researcher Kevin Beaumont noted that the attack was highly targeted, with specific organizations reporting incidents linked to Notepad++ processes.

Notepad++ Official Update Mechanism Hijacked to Deliver Malware to Select UsersNotepad++ Supply Chain Hack Conducted by China via Hosting ProviderNotepad++ Secures Update Chain Post Targeted BreachHow state-sponsored attackers hijacked Notepad++ updatesNation-State Hackers Hijacked Notepad++ Updates via Hosting Infrastructure ExploitNotepad++ Update Hijacking Linked to Hosting Provider CompromiseNotepad++ patches update chain after targeted compromise

Following the breach, Notepad++ transitioned to a new hosting provider with enhanced security measures. The update process was fortified to include:

Nation-State Hackers Hijacked Notepad++ Updates via Hosting Infrastructure Exploit

• Verification of installer certificates and signatures.

Notepad++ Secures Update Chain Post Targeted Breach

• Signed update data to ensure integrity.

Notepad++ Official Update Mechanism Hijacked to Deliver Malware to Select Users

The upcoming version 8.9.2 is expected to enforce these stricter security checks.

Notepad++ Secures Update Chain Post Targeted Breach

Don Ho, the maintainer of Notepad++, stated, “The exact technical mechanism remains under investigation, though the compromise occurred at the hosting provider level rather than through vulnerabilities in Notepad++ code itself.” He emphasized the commitment to safeguarding the integrity of Notepad++ and apologized to affected users.

How state-sponsored attackers hijacked Notepad++ updates

Despite the swift response from Notepad++, some experts, including Beaumont, cautioned against overreacting while advising organizations to monitor for unusual network activity related to Notepad++. He noted, “Activity appears very targeted,” suggesting that while the breach was serious, it was not indiscriminate.

Notepad++ patches update chain after targeted compromise

There are discrepancies regarding the exact timeline of the attack's cessation. While some reports indicate that the attackers lost access on November 10, 2025, the hosting provider maintained that potential access continued until December 2, 2025. This gap in information raises questions about the full extent of the attackers' capabilities during the compromise.

Nation-state hack exploited hosting infrastructure to hijack Notepad++ updates

The Notepad++ incident underscores the critical importance of securing hosting infrastructures against supply chain attacks. With the implementation of enhanced security measures and a transition to a more secure hosting provider, Notepad++ aims to restore user confidence and mitigate the risks of future attacks. Users are advised to remove any previously installed self-signed root certificates and to ensure they are using the latest version of the software.

Nation-State Hackers Hijacked Notepad++ Updates via Hosting Infrastructure ExploitNotepad++ Secures Update Chain Post Targeted BreachNotepad++ Update Hijacking Linked to Hosting Provider CompromiseNotepad++ Supply Chain Hack Conducted by China via Hosting ProviderHow state-sponsored attackers hijacked Notepad++ updatesNation-state hack exploited hosting infrastructure to hijack Notepad++ updatesNotepad++ patches update chain after targeted compromise