Chinese Government Hackers Compromise Notepad++ Update Mechanism

In a significant security breach, hackers associated with the Chinese government hijacked the update mechanism of Notepad++, a widely used open-source text editor, delivering malicious software to targeted users from June to December 2025. The attack, attributed to the espionage group Lotus Blossom, specifically targeted sectors including government, telecommunications, aviation, critical infrastructure, and media, according to Notepad++ developer Don Ho and security experts.

Notepad++ says Chinese government hackers hijacked its software updates for months | TechCrunch | technologyChinese Hackers Hijack Notepad++ Updates for MonthsNotepad++ says Chinese government hackers hijacked its software updates for monthsNotepad++ Supply Chain Hack Conducted by China via Hosting ProviderHijacked Notepad++ updater quietly targeted users for monthsNation-state hack exploited hosting infrastructure to hijack Notepad++ updates

The compromise occurred through a vulnerability in the shared hosting infrastructure used by Notepad++. Attackers exploited this weakness to redirect update requests from certain users to malicious servers controlled by them. This allowed the hackers to deliver tainted software updates without directly compromising Notepad++'s source code. The attack was characterized by its selective targeting, which security researchers noted as indicative of a sophisticated espionage operation rather than a broad malware campaign.

Notepad++ Supply Chain Hack Conducted by China via Hosting ProviderChinese Hackers Hijack Notepad++ Updates for MonthsNation-state hack exploited hosting infrastructure to hijack Notepad++ updatesNotepad++ says Chinese government hackers hijacked its software updates for monthsNotepad++ Says Chinese Government Hackers Hijacked UpdatesNotepad++ Updates Delivered Malware After Hosting Provider Breach

• June 2025: Attackers gain initial access to the hosting provider's infrastructure.

Nation-state hack exploited hosting infrastructure to hijack Notepad++ updates

• September 2, 2025: Scheduled maintenance updates the server's kernel and firmware, cutting off direct access for the attackers.

Nation-state hack exploited hosting infrastructure to hijack Notepad++ updates

• November 10, 2025: Security experts assess that the attack ceased, although the hosting provider reported potential access until December 2, 2025.

Nation-state hack exploited hosting infrastructure to hijack Notepad++ updates

• December 2025: The breach is publicly disclosed by Notepad++ after security researcher Kevin Beaumont identifies suspicious activity.

Chinese Hackers Hijack Notepad++ Updates for Months

Don Ho publicly acknowledged the breach, apologizing to users and urging them to download the latest version of Notepad++ to mitigate risks. He emphasized that the incident highlighted vulnerabilities in software supply chains and the need for robust security measures. Ho stated, “With these changes and reinforcements, I believe the situation has been fully resolved. Fingers crossed.”

Notepad++ says Chinese government hackers hijacked its software updates for months | TechCrunch | technology

Experts have raised concerns about the implications of such a targeted attack on open-source software. Cassius Edison, COO of Closed Door Security, remarked, “This attack represents another serious supply chain attack, potentially affecting millions of devices.” Critics argue that the incident underscores the ongoing risks associated with trusted software distribution channels, emphasizing the need for enhanced security protocols.

Notepad++ Updates Delivered Malware After Hosting Provider Breach

While the security analysis indicates that the attackers maintained access until December 2, 2025, there is some discrepancy regarding the exact timeline of the attack's cessation. Security experts suggest that the main malicious activities ended on November 10, while the hosting provider noted potential access until early December.

Nation-state hack exploited hosting infrastructure to hijack Notepad++ updates

In response to the breach, Notepad++ has migrated to a new hosting provider and implemented significant changes to its update verification processes. The upcoming version 8.9.2 will enforce stricter checks on update integrity, including signed update data and enhanced client-side verification measures.

Notepad++ Updates Delivered Malware After Hosting Provider Breach

The Notepad++ incident serves as a stark reminder of the vulnerabilities inherent in software supply chains, particularly for widely used open-source projects. As nation-state actors increasingly target such infrastructures, the need for robust security measures and user vigilance becomes paramount.

Notepad++ Updates Delivered Malware After Hosting Provider Breach