Notepad++ Hijacked by State-Sponsored Hackers — The Truth Behind the Software Update Chain Attack
🔐 Notepad++ Hijacked by State-Sponsored Hackers — The Truth Behind the Software Update Chain Attack
Published: February 3, 2026
📈 Global Search Trends
Search volume for this keyword is currently on the rise.
| Country | Search Volume |
|---|---|
| 🇺🇸 United States (US) | 10K+ |
| 🇨🇦 Canada (CA) | 2K+ |
| 🇦🇺 Australia (AU) | 500+ |
| 🇹🇼 Taiwan (TW) | 100+ |
| 🇰🇷 South Korea (KR) | 100+ |
Why Is Notepad++ Making Headlines Right Now?
On February 2, 2026, Don Ho, the developer behind the open-source text editor used by tens of millions worldwide — Notepad++ — made a shocking official announcement. A state-sponsored hacker group linked to the Chinese government had taken control of Notepad++'s software update mechanism for approximately six months, distributing malware to certain users during that period.
Following the announcement, search volumes related to Notepad++ have increased across multiple countries. The United States alone recorded over 10,000 searches in a single day, with Canada (2K+), Australia (500+), Taiwan and South Korea (100+ each) also seeing a notable uptick. This reflects growing concern among developers and corporate security professionals about the incident.
How the Attack Unfolded
Phase 1 — Hosting Server Compromise (June 2025)
The attack began in June 2025. The hackers breached the shared hosting server where the official Notepad++ website was hosted. The compromise did not occur through a vulnerability in the Notepad++ application's code itself, but rather at the infrastructure level of the hosting environment.
Phase 2 — Update Traffic Redirection
The hackers specifically targeted Notepad++'s update endpoint, getDownloadUrl.php. This endpoint is the critical pathway used by Notepad++'s built-in updater, WinGUp, to download new versions. By redirecting certain users' update requests to attacker-controlled servers, the hackers delivered trojanized installation files instead of legitimate updates.
Phase 3 — Extended Persistence and Termination (September – December 2025)
According to the hosting provider, the shared server remained compromised until September 2, 2025. A scheduled maintenance update to the kernel and firmware cut off the attackers' direct server access. However, having already obtained credentials for internal services, the hackers were able to continue manipulating update traffic until December 2, 2025. Independent security researchers have assessed that actual malicious activity ceased around November 10, 2025.
Behind the Attack — Chinese State-Sponsored Hacker Groups
Security researcher Kevin Beaumont was the first to identify the incident, and multiple independent researchers have attributed the attack to Chinese state-sponsored groups, specifically Lotus Blossom (APT31) or Violet Typhoon (Zirconium).
According to an investigation by security firm Rapid7, the primary targets were organizations in the government, telecommunications, aviation, critical infrastructure, and media sectors — particularly those tied to East Asian interests. Beaumont noted that "at least three organizations experienced security incidents in which the Notepad++ process was used as a vector for initial access."
The attack follows a pattern consistent with the SolarWinds attack (2019–2020), a well-known software supply chain compromise.
Notepad++'s Response and Security Measures
The Notepad++ development team responded swiftly and proactively to the incident.
Security patches by version:
- v8.8.8 (November 2025): Update download sources restricted exclusively to GitHub, blocking external redirection.
- v8.8.9 (December 9, 2025): Digital signature and certificate verification enforced; unsigned installation files can no longer be executed.
- v8.9 (Current): Self-signed certificates have been deprecated; only official GlobalSign certificates are now accepted.
- v8.9.2 (Upcoming): Mandatory certificate signature verification based on XMLDSig to be introduced.
In addition, Notepad++ migrated to a new hosting provider with stronger security capabilities and regenerated all credentials that could have been obtained by the attackers.
Security Checklist for Notepad++ Users
If you are currently using Notepad++, the following steps are recommended:
- Update to the latest version (v8.9 or later) immediately — Perform the update via manual installation.
- Remove any existing self-signed root certificates — If a self-signed certificate was installed in versions after v8.8.3, delete it.
- Corporate environments: Block internet access for
notepad-plus-plus.orgor thegup.exeprocess, and manage updates through an internal package management system. - Verify digital signatures — Confirm that the digital signature on any downloaded installation file is valid before running it.
What This Incident Teaches Us
The Notepad++ incident is not simply a problem with one piece of software. It is a case that once again underscores the importance of Software Supply Chain Security. The source code of Notepad++ itself was never compromised — it was a vulnerability at the infrastructure level of how updates were delivered that ultimately determined the success of the attack.
The increase in search volume and attention across the United States, Canada, Australia, Taiwan, South Korea, and other nations is a signal that global concern over software supply chain security is growing. The reason this incident has drawn significant attention is that Notepad++ is a tool used by tens of millions of developers and organizations worldwide.
Sources and References
- Notepad++ Official Security Notice: https://notepad-plus-plus.org/news/hijacked-incident-info-update/
- The Hacker News: https://thehackernews.com/2026/02/notepad-official-update-mechanism.html
- TechCrunch: https://techcrunch.com/2026/02/02/notepad-says-chinese-government-hackers-hijacked-its-software-updates-for-months/
- The Register: https://www.theregister.com/2026/02/02/notepad_plusplus_intrusion/
- BleepingComputer: https://www.bleepingcomputer.com/news/security/notepad-plus-plus-update-feature-hijacked-by-chinese-state-hackers-for-months/
- SecurityWeek: https://www.securityweek.com/notepad-supply-chain-hack-conducted-by-china-via-hosting-provider/
- Help Net Security: https://www.helpnetsecurity.com/2026/02/02/2025-notepad-supply-chain-compromise/
- The Record (Recorded Future): https://therecord.media/popular-text-editor-hijacked-by-suspected-state-sponsored-hackers
🔗 Related Trend Links (TrendNow)
For more detailed search trend information, visit the TrendNow links below:
👉 TrendNow — Notepad++ Trend (Australia)
TrendNow Homepage: https://trend-now.org
Comments
Post a Comment