Chinese State Hackers Hijacked Notepad++ Update Feature for Months

In an alarming cybersecurity incident, Chinese state-sponsored threat actors compromised the Notepad++ update feature, which lasted from June 2025 until December 2, 2025. The attackers exploited a security gap in the update verification controls, allowing them to intercept and redirect update requests from specific users to their malicious servers. This breach was confirmed by the Notepad++ developer and external security experts, who noted the highly selective targeting of the attack.

The attackers gained access by compromising the server hosting the Notepad++ update application. Although they temporarily lost access in early September 2025 due to a server update, they regained control using previously obtained internal service credentials. This breach continued until it was detected by the hosting provider, which then terminated the attackers’ access.

Notepad++ is a widely used free and open-source text and source code editor, with millions of users globally. The incident highlights significant risks associated with insufficient update verification controls, particularly for software that is popular among developers and organizations.

Implications for Users and Organizations

This incident serves as a reminder of the importance of robust security measures in software updates. Users of Notepad++ should be vigilant about potential security risks, especially when using software that relies on external update mechanisms. The selective targeting observed in this attack suggests that threat actors may be focusing on specific organizations or user groups.

Organizations should ensure that they are using the latest versions of software and that any vulnerabilities are addressed promptly. Notepad++ has since released version 8.8.9, which includes improved security measures such as cryptographic signing of update XML files and installer certificates.

As a precaution, users are advised to monitor their systems for any unusual activity and to change credentials that may have been compromised during the attack. The incident underscores the need for continuous vigilance and proactive security practices in the face of evolving cyber threats.

• Notepad++: A free and open-source text and source code editor popular among developers.
• Update Verification Controls: Security measures that verify the authenticity of software updates.
• Chinese State-Sponsored Threat Actors: Cybercriminals believed to be working on behalf of the Chinese government.
• Version 8.8.9: The latest Notepad++ release that addresses security vulnerabilities in the update mechanism.
• Malicious Servers: Servers controlled by attackers used to distribute harmful software updates.