Notepad++ Update Infrastructure Breached by Chinese Hackers

Developers of the popular Windows text editor Notepad++ disclosed on Monday that suspected Chinese state-sponsored hackers compromised its update infrastructure for six months starting in June 2025, selectively redirecting traffic to deliver malicious software to targeted users.

The breach, detailed in a statement from maintainer Don Ho on the official notepadplusplus.org website, involved an infrastructure-level compromise at the software's former shared hosting provider. Attackers gained control of the server, allowing them to intercept update requests and redirect specific users to attacker-controlled servers. These servers served backdoored versions of Notepad++ updates, exploiting weaknesses in the WinGUP updater mechanism that lacked sufficient verification of downloaded files in older versions. The compromise did not affect the Notepad++ code itself but targeted the update process to distribute spyware or other malware.

According to the hosting provider's investigation, shared with Ho and external security experts, the server remained under attacker control until September 2, 2025, when scheduled kernel and firmware updates severed direct access. However, the hackers...