Notepad++ Compromise Explained: What Happened & What to Do

Notepad++ is a tool almost every engineer uses, which is exactly why its recent compromise matters. In early February 2026, the Notepad++ maintainer confirmed a targeted supply chain attack that quietly hijacked update traffic for months.

If you manage endpoints, software distribution, or security controls, this is worth your full attention. Not because Notepad++ code was hacked, but because the attack shows how much trust we place in update infrastructure.

If you want a second set of eyes on how third-party software is managed in your environment, this is the sort of scenario we help organisations review. Get in touch to learn more.

What actually happened in the Notepad++ compromise

This was not a typical malware incident and not a vulnerability in the Notepad++ codebase.

According to updates shared by the Notepad++ maintainer and independent research by Rapid7 and Kaspersky, the attack unfolded like this:

• Attackers compromised infrastructure at Notepad++’s shared hosting provider.
• This allowed them to intercept and selectively redirect update requests.
• Only certain users were targeted, not everyone.
• Older versions of Notepad++ lacked strong update verification controls.
• Malicious update manifests were served instead of legitimate ones.

The compromise window is estimated to span June 2025 through early December 2025, with some disagreement between investigators on the exact end date. The maintainer estimates full attacker access was definitively terminated on 2 December 2025.

Importantly, there is no evidence the Notepad++ source code, repositories, or signing keys were breached. This was a hosting and update delivery problem, not a development one.

Official disclosure: https://notepad-plus-plus.org/news/hijacked-incident-info-update/

Notepad++ breach timeline and hosting provider failure

Here’s how the events unfolded.

June 2025

• Attackers gained access to a shared hosting server used by Notepad++ for update-related infrastructure.

June to September 2025

• Attackers had active access to the compromised server.
• They selectively redirected traffic destined for the Notepad++ update endpoint.
• Targeting was highly specific, consistent with a state-sponsored operation.

September 2nd 2025

• Hosting provider performed kernel and firmware updates.
• Direct attacker access to the server appears to have been cut off at this point.

September to December 2025

• Despite losing server access, attackers retained credentials to internal services.
• This still allowed traffic redirection for certain update requests.
• Notepad++ domain traffic was explicitly targeted, not other tenants.

December 2nd 2025

• All credentials rotated.
• Hosting provider reports no further malicious activity.
• Notepad++ infrastructure fully migrated to a new provider.

This detail matters. It shows how credential hygiene and internal service access can extend the blast radius of a breach well beyond the initial intrusion.

How the Notepad++ supply chain attack worked technically

This incident is a textbook supply chain compromise, but with a few twists.

Selective update hijacking

Attackers did not blanket-infect users. Instead, they:

• Identified specific targets.
• Redirected update traffic only for those systems.
• Served malicious installers disguised as legitimate updates.

This dramatically reduced detection and noise.

Malicious update payloads

Analysis from Rapid7 and Kaspersky identified a backdoor dubbed Chrysalis, delivered via tampered update installers.

Key technical details:

• The malicious file was typically named update.exe.
• It was an NSIS installer launched by the legitimate updater (gup.exe).
• DLL side-loading was used, abusing legitimate binaries.
• Encrypted shellcode was deployed to establish persistence and C2 access.

Chrysalis capabilities included:

• System information collection
• File operations
• Process creation
• Download and execution of additional payloads
• Self-removal

Rapid7 analysis: https://thehackernews.com/2026/02/notepad-hosting-breach-attributed-to.html

Attribution

With medium confidence, researchers attributed the activity to Lotus Blossom, a China-linked threat actor (also known as Billbug, Lotus Panda, Spring Dragon, Thrip, Raspberry Typhoon or Bronze Elgin).

Targets included:

• Government organisations
• Financial institutions
• IT service providers
• Organisations in Australia, Vietnam, the Philippines, and El Salvador

This was espionage-driven, not mass malware distribution.

Why this Notepad++ compromise is different

There are three reasons this incident stands out.

1. Trusted tooling

Notepad++ is ubiquitous. It runs on privileged workstations, servers, and jump boxes. That makes it an attractive pivot point.

2. Update trust assumptions

Many environments implicitly trust software updaters. If the updater runs, it is assumed safe. This attack broke that assumption without touching the codebase.

3. Quiet targeting

The low infection volume meant traditional detection tools had little to correlate. No widespread outbreaks. No obvious indicators.

For IT teams, this reinforces an uncomfortable truth. If a legitimate update channel is compromised, traditional controls struggle unless additional verification exists.

What Notepad++ changed after the breach

To their credit, the Notepad++ maintainer moved quickly once the scope was understood.

Key changes include:

• Migration to a new hosting provider with stronger security controls
• Rotation of all credentials
• Enhancements to the WinGup updater in v8.8.9
• Certificate and signature verification for installers
• XML update manifests are now signed using XMLDSig
• Full enforcement of verification expected in v8.9.2

Users are strongly advised to manually install v8.9.1 or later.

Official update notes: https://notepad-plus-plus.org/news/v889-released/

One important limitation remains. There are no published Indicators of Compromise (IoCs) from the Notepad++ team due to the lack of concrete artefacts in hosting logs. Kaspersky and Rapid7 have since published their own findings with more technical detail.

What IT teams should do now

If Notepad++ exists anywhere in your environment, take this seriously but stay calm.

Immediate checks

• Identify all systems with Notepad++ installed.
• Confirm installed versions are 8.9.1 or newer.
• Remove older versions entirely rather than upgrading in place where possible.

Endpoint review

• Review EDR alerts from June to December 2025.
• Look for unusual child processes spawned from notepad++.exe or gup.exe.
• Investigate any executions of update.exe during that window.

Privileged workstation hygiene

• Treat developer and admin workstations as high-value assets.
• Restrict local admin rights.
• Enforce application control where feasible.

Update control improvements

• Prefer offline installers distributed via trusted internal channels.
• Block direct updater traffic where it cannot be validated.
• Validate signatures on internally packaged software.

This is not about banning useful tools. It is about controlling how they enter and update within your environment.

Lessons from the Notepad++ breach for Australian organisations

This incident lands close to home. Australian organisations were among those targeted.

Key takeaways:

• Shared hosting is still widely used for open-source projects.
• Infrastructure compromise can bypass code security entirely.
• Update verification is not optional anymore.
• Selective targeting means absence of evidence is not evidence of absence.

For councils, schools, MSPs, and mid-sized enterprises, this reinforces the need for basic discipline. Asset visibility, update control, and endpoint monitoring still matter more than shiny tools.

Final Thoughts on the Notepad++ Compromise

The Notepad++ compromise was not loud, fast, or widespread. That is what makes it dangerous.

A trusted tool, a trusted update channel, and a long dwell time. No zero-day. No user clicking dodgy links. Just infrastructure trust quietly abused.

If you have not reviewed how third-party tools are deployed and updated across your environment, this is your nudge to do it properly.

If you want help pressure-testing your software supply chain controls, you can get in touch with us here.

Online Enquiry

Contact Us Today

Got questions, ideas, or just want to chat? We'd love to hear from you! Reach out to us anytime, and we'll get back to you with all the help and information you need.