# Chinese Hackers Seized Notepad++ Updates for Months
In a shocking revelation, the popular open-source text editor Notepad++ has disclosed that Chinese state-sponsored hackers hijacked its update mechanism for nearly six months in 2025, redirecting select users to malicious servers and potentially delivering malware.[1][2][3] Developer Don Ho confirmed the infrastructure-level breach at the former hosting provider, emphasizing that it exploited weak update verification rather than flaws in the app's code, urging millions of users worldwide to update immediately for enhanced security.[1][4]
How the Notepad++ Update Hijacking Unfolded
The attack began in June 2025 when hackers compromised a shared hosting server handling Notepad++ update requests, allowing them to intercept traffic destined for notepad-plus-plus.org.[1][2][3] Attackers selectively redirected updates from targeted users to rogue servers serving tampered manifests, a tactic linked to Chinese state-sponsored groups due to its precision and narrow scope.[1][3][5]
Even after the hosting provider updated the server kernel and firmware in early September 2025, cutting direct access, the hackers retained stolen internal service credentials, sustaining the breach until December 2, 2025.[1][2][4] Independent researchers, including Kevin Beaumont, confirmed the campaign's exploitation for network compromises, highlighting it as a sophisticated supply chain attack on a tool used by tens of millions of developers and IT professionals.[2][3]
Evidence Points to Chinese State-Sponsored Attackers
Multiple security experts assessing the incident attribute it to China-linked threat actors, citing the operation's patience, selective targeting, and alignment with advanced persistent threat (APT) behaviors typical of state operations rather than opportunistic cybercriminals.[1][3][5] Notepad++ maintainer Don Ho noted in the official announcement that the attackers focused on the domain's insufficient update controls in older versions, enabling malware delivery without broad disruption.[1][2]
The breach's infrastructure focus—not code vulnerabilities—underscores risks in third-party hosting, with the former provider confirming the server's compromise until September and lingering credential access afterward.[1][4][5] This mirrors broader trends in state-sponsored cyberattacks on software supply chains, as seen in expert commentary from figures like Cassius Edison of Closed Door Security.[5]
Notepad++ Response: Stronger Security Measures Implemented
In response, Notepad++ swiftly migrated its website and update services to a new hosting provider with robust security practices.[2][3][4] Key fixes include version 8.8.9's WinGup updater now verifying both installer certificates and signatures, plus signed XML update responses using XMLDSig, with full enforcement in upcoming v8.9.2.[2][4]
Ho advises users to manually download and install the latest version (at least 8.9.1) to bypass risks, apologizing for the incident while stressing proactive defenses against such hosting provider breaches.[1][4] These updates address the core flaw where intercepted traffic could trick the updater into fetching poisoned executables.[3][5]
Implications for Software Security and Users
This incident exposes vulnerabilities in trusted update channels for popular tools like Notepad++, a staple for Windows users editing code and text, amplifying risks for developers, admins, and researchers.[1][5] It serves as a wake-up call for enhanced verification in open-source software amid rising supply chain attacks.[3]
Users facing potential exposure should scan systems for malware, disable auto-updates temporarily if on vulnerable versions, and adopt multi-layered defenses like endpoint detection.[2][4] The event reinforces the need for diversified hosting and rigorous credential management in software ecosystems.[5]
Frequently Asked Questions
What exactly happened in the Notepad++ hack?
Chinese state-sponsored hackers compromised Notepad++'s hosting provider starting in June 2025, hijacking update traffic to redirect select users to malicious servers delivering tampered updates.[1][2][3]
How long did the Notepad++ update hijacking last?
The breach ran from June 2025 until December 2, 2025—nearly six months—with direct server access ending in September but credential-based redirection continuing afterward.[1][4][5]
Who is behind the Notepad++ attack?
Security researchers link it to a **Chinese state-sponsored group**, based on targeting precision and tactics matching known APT operations.[1][3][5]
Is Notepad++ safe to use now?
Yes, after migrating to a new host and releasing secure updates like v8.8.9 and v8.9.2 with certificate/signature verification; users should manually install the latest version.[2][4]
How can Notepad++ users protect themselves?
Download updates manually from the official site, enable signature verification in v8.8.9+, scan systems for malware, and monitor for suspicious activity.[1][2][4]
Was the Notepad++ breach due to a flaw in the software code?
No, it stemmed from an infrastructure compromise at the hosting provider, not vulnerabilities in Notepad++'s source code.[1][3][5]
What changes did Notepad++ make to prevent future hijacks?
Updates now include WinGup certificate/signature checks, signed XML responses (XMLDSig), and a switch to a more secure hosting provider.[2][4]
🔄 Updated: 2/2/2026, 6:20:40 PM
**Chinese state-sponsored hackers hijacked Notepad++ software updates between June and December 2025**, redirecting certain users to malicious servers and gaining "hands-on" access to their systems[1][2]. The attackers compromised the shared hosting server and exploited insufficient update verification controls in older versions of the text editor, with the breach maintained through stolen internal credentials even after the hosting provider regained server access in September[2][4]. Notepad++ developer Don Ho has urged users to download version 8.8.9 or later, which now includes certificate signature verification, with mandatory enforcement coming in version 8.9.2 expected in about a month[2].
🔄 Updated: 2/2/2026, 6:30:44 PM
**BREAKING: Expert Analysis Confirms Chinese State Hackers Hijacked Notepad++ Updates for 6 Months**
Security researchers assessing the breach, which ran from June to December 2, 2025, via a compromised shared hosting provider, attribute it to a **Chinese state-sponsored APT group** due to its "highly selective targeting" of users with East Asia interests, as stated by Notepad++ developer Don Ho[2][3]. Kevin Beaumont, the researcher who first uncovered the attack, noted hackers gained "hands-on" access to victims' computers after redirecting a small number of organizations to malicious binaries[2]. Cassius Edison, COO of Closed Door Security, warned that the incident "highlights ongoing risks aroun
🔄 Updated: 2/2/2026, 6:40:47 PM
**NEWS UPDATE: Notepad++ Hack Reshapes Open-Source Editor Competitive Landscape**
The Notepad++ supply chain attack by Chinese state-sponsored hackers from June to December 2025 has eroded trust in its update mechanism, prompting a migration to a new secure hosting provider and stricter verification in v8.9.2, including signed update data and installer certificates.[1][3][4] Developer Don Ho noted the "highly selective targeting" favored rivals like Visual Studio Code, whose robust Microsoft-backed security now positions it to capture more of Notepad++'s **tens of millions** of Windows users amid rising scrutiny of open-source tools.[2][5][7] Security researcher Kevin Beaumont reported incidents in at least **
🔄 Updated: 2/2/2026, 6:50:53 PM
**LIVE NEWS UPDATE: Chinese Hackers Hijack Notepad++ Updates – Global Fallout Grows**
The state-sponsored Chinese hacking campaign, which hijacked Notepad++'s update mechanism from June to December 2025, compromised a "small number of organizations with interests in East Asia," granting attackers "hands-on" access to victim computers via tampered updates served to selectively targeted users worldwide[1][7]. Security researcher Kevin Beaumont reported incidents across at least three organizations where Notepad++ processes enabled initial breaches, sparking urgent global alerts reminiscent of the SolarWinds attack[1][7]. In response, Notepad++ migrated to a new hosting provider, patched update verification flaws in versions prior to 8.8.9, an
🔄 Updated: 2/2/2026, 7:00:54 PM
Chinese state-sponsored hackers hijacked Notepad++ software updates between June and December 2025, selectively redirecting certain users to malicious servers to deliver a custom backdoor called Chrysalis[1][2]. The attackers exploited insufficient update verification controls in older versions of the editor after compromising the hosting provider's server, gaining "hands-on" access to networks with interests in East Asia[1][3]. Security researcher Kevin Beaumont first discovered the campaign in December, identifying three organizations that suffered security incidents after downloading the compromised updates[1].
🔄 Updated: 2/2/2026, 7:10:54 PM
**LIVE UPDATE: No Official Government Response to Notepad++ Hack**
As of February 2, 2026, no regulatory bodies or governments—including the U.S. CISA or international cybersecurity agencies—have issued public statements, sanctions, or investigations into the Chinese state-sponsored hackers who hijacked Notepad++ updates from June to December 2, 2025.[2][3][5] Notepad++ developer Don Ho and external experts like Rapid7 attributed the selective attack to groups such as Lotus Blossom, but Ho noted the breach mechanism remains under private investigation with hosting provider hardening, including credential rotation and XMLDSig enforcement in version 8.9.2.[3][4] Security researcher Kevin Beaumont reported incidents a
🔄 Updated: 2/2/2026, 7:20:57 PM
Notepad++ developer Don Ho confirmed today that Chinese state-sponsored hackers, likely the APT group Lotus Blossom (a.k.a. Raspberry Typhoon), hijacked the software's update mechanism from June to December 2025 by compromising its shared hosting server and exploiting weak verification controls in versions before 8.8.9[1][2][3]. The attackers selectively redirected update traffic from targeted users—primarily organizations with East Asia interests—to malicious servers, delivering malware like the custom backdoor Chrysalis, with access persisting via stolen credentials even after a September 2 server kernel update until termination on December 2[1][2][5]. Security researcher Kevin Beaumont first flagged the "highly selective targeting" in Decembe
🔄 Updated: 2/2/2026, 7:30:55 PM
**BREAKING: Expert analysis confirms Chinese state-sponsored hackers hijacked Notepad++ updates from June to December 2025, exploiting weak verification controls on a shared hosting server to redirect targeted users—likely those with East Asia interests—to malicious servers.[1][2][5]**
Security researcher **Kevin Beaumont**, who first uncovered the breach, stated hackers gained "hands-on" access to victims' computers via tainted updates, describing a "small number of organizations" affected after unwitting installs.[1]
Notepad++ developer Don Ho cited multiple independent experts attributing the "highly selective targeting" to a Chinese government-linked group, noting the attackers briefly lost access in early September but regained it using unchanged credentials until termination on December 2.[1]
🔄 Updated: 2/2/2026, 7:40:56 PM
**Chinese state-sponsored hackers compromised Notepad++'s update system between June and December 2025**, selectively redirecting update requests from targeted users to malicious servers that delivered tampered software[1][2]. Security researchers, including analyst Kevin Beaumont, discovered that victims experienced "hands-on" access by threat actors after installing the hijacked versions, with the attack targeting organizations with interests in East Asia[1]. The breach exploited insufficient update verification controls in older Notepad++ versions and occurred at the hosting provider infrastructure level rather than through flaws in the application itself, until the attacker's access was definitively terminated on December 2, 2025[3][5].
🔄 Updated: 2/2/2026, 7:50:56 PM
**NEWS UPDATE: No Government Response to Notepad++ Hack**
As of February 2, 2026, no regulatory or government bodies have issued statements or actions regarding the Chinese state-sponsored hackers who hijacked Notepad++ updates from June to December 2025, despite attributions by developer Don Ho and firms like Rapid7 to groups such as Lotus Blossom[1][3][5]. Notepad++ responded independently by migrating to a new hosting provider with enhanced security, adding XMLDSig digital signatures to update responses in version 8.9.2, and strengthening WinGUP verifier signatures in 8.8.9[5][7]. The hosting provider conducted forensics, rotated credentials, patched vulnerabilities, and confirme
🔄 Updated: 2/2/2026, 8:00:54 PM
**NEWS UPDATE: Market Unmoved by Notepad++ Hack Revelation**
The disclosure of Chinese state-sponsored hackers hijacking Notepad++ software updates from June to December 2025 elicited no observable market reactions, with no reported volatility in related cybersecurity stocks or open-source software indices.[1][2][3] Investors appeared unfazed by the targeted supply chain attack—likened to the SolarWinds breach—due to its narrow scope on East Asia-interested organizations, as confirmed by developer Don Ho: “the highly selective targeting observed during the campaign.”[1][4] No specific stock price movements or analyst downgrades were noted in immediate trading sessions following the February 2 announcements.[2][7]
🔄 Updated: 2/2/2026, 8:10:58 PM
**NEWS UPDATE: Public Alarmed by Notepad++ Hack, Urges Caution on Updates**
Consumers and developers expressed widespread shock and frustration over Chinese state-sponsored hackers hijacking Notepad++ updates from June to December 2025, with security researcher Kevin Beaumont reporting incidents at "3 orgs" where the tainted software enabled "hands-on keyboard threat actors," primarily targeting East Asia interests[1][8]. Social media buzzed with users vowing to "only download from notepad-plus-plus.org" and migrate to new hosts, as Notepad++ developer Don Ho noted the attack's "highly selective targeting" fueled fears of broader supply chain risks[2][6]. No mass infections were confirmed, but tens of millions of globa
🔄 Updated: 2/2/2026, 8:20:54 PM
**Breaking: Technical Analysis of Notepad++ Hijack**
Chinese state-sponsored hackers exploited a shared hosting server's vulnerability from June to September 2, 2025, then used stolen internal credentials to redirect update traffic for targeted users—primarily organizations with East Asian interests—to attacker-controlled servers delivering malware until December 2, granting "hands-on" access without compromising Notepad++ code itself[1][3][7]. Developer Don Ho stated, "The cyberattack was likely carried out by hackers associated with the Chinese government... this would explain the highly selective targeting," as confirmed by researcher Kevin Beaumont who identified incidents in three such organizations[1][2][6]. Implications include escalated risks to open-source supply chains, prompting Notepa
🔄 Updated: 2/2/2026, 8:30:55 PM
**BREAKING: Chinese state-sponsored hackers hijacked Notepad++ updates from June to December 2025, selectively targeting organizations with East Asia interests and granting "hands-on" access to victims' systems, as confirmed by developer Don Ho and researcher Kevin Beaumont.** This supply-chain attack, mirroring the 2019 SolarWinds breach, exposed tens of millions of global users of the popular Windows text editor to potential malware via compromised hosting infrastructure.[1][2][6] No official international responses have emerged yet, but Notepad++ has bolstered update verification in v8.9.2 and urged manual installs, with experts attributing the "highly selective targeting" to a Chinese government-linked group.[3][5]
🔄 Updated: 2/2/2026, 8:40:56 PM
Chinese state-sponsored hackers compromised Notepad++'s hosting infrastructure and hijacked software updates between June and December 2025, redirecting targeted users to malicious servers that delivered poisoned executables[1][2]. The attackers exploited a vulnerability in WinGUp, the Notepad++ updater tool, which failed to properly verify downloaded file integrity, allowing network traffic interception to trick users into downloading malware instead of legitimate updates[2]. Even after losing direct server access on September 2, 2025, the hackers maintained stolen credentials to internal services until December 2, 2025, enabling them to continue redirecting update traffic to attacker-controlled servers for an additional three months