Notepad++ Update Mechanism Hijacked to Deliver Malware

Notepad++ maintainer Don Ho has disclosed that state-sponsored attackers hijacked the utility’s official update mechanism, redirecting traffic to malicious servers and delivering poisoned executables to select users.

Incident Overview

• Attack Vector: Infrastructure-level compromise at the hosting provider, not a flaw in Notepad++ code.
• Timeline:
  • Malicious redirection began in June 2025.
  • Hosting provider compromise lasted until September 2, 2025.
  • Attackers retained internal service credentials until December 2, 2025, enabling continued redirection.
• Targeting: Highly selective—only traffic from certain users was routed to rogue servers.
• Discovery: Publicly revealed in February 2026 after investigation.

Technical Details

• Updater involved: WinGUp, the Notepad++ update client.
• Weakness: Integrity/authentication checks on update files were insufficient.
• Exploitation:
  • Attackers intercepted traffic between updater client and update server.
  • Redirected requests to malicious domains.
  • Delivered poisoned binaries disguised as legitimate updates.
• Researcher Insight: Independent analyst Kevin Beaumont confirmed exploitation by China-linked threat actors.

Impact

• Scope: Unknown number of users, but limited to those whose traffic was redirected.
• Risk:
  • Download and execution of malware via trusted update channel.
  • Potential compromise of developer and enterprise environments relying on Notepad++.
• Persistence: Attackers maintained access even after losing direct server control, leveraging stolen credentials.

Mitigation & Response

• Immediate Action:
  • Notepad++ website migrated to a new hosting provider.
  • Version 8.8.9 released to address updater redirection issues.
• Recommended Steps for Users:
  • Verify update sources and digital signatures.
  • Reinstall Notepad++ from trusted official downloads.
  • Audit systems for suspicious binaries if updates were applied between June–December 2025.
  • Apply endpoint monitoring for anomalous traffic.

Takeaway

This incident underscores the critical risk of supply chain and update mechanism compromises. Even widely trusted tools like Notepad++ can be weaponized when attackers infiltrate hosting infrastructure. Organizations must enforce strong integrity checks, secure hosting environments, and credential hygiene to prevent similar hijacks.