Back
Notepad++ Hijacked by State-Sponsored Actors in Targeted Supply-Chain Attack

Notepad++ Hijacked by State-Sponsored Actors in Targeted Supply-Chain Attack

NEWS Publication date: 2026-02-02

On February 2, 2026, the developer of Notepad++ disclosed a serious security incident involving the project’s update infrastructure. State-sponsored attackers had gained prolonged access to parts of the hosting environment used by Notepad++ and abused this access to distribute malicious updates to a very limited, carefully selected group of users.

It is important to emphasize that regular Notepad++ users were not broadly affected. There was no mass compromise and no indication that the general user base was targeted. Instead, the attackers focused on specific organizations with strategic interests, primarily in East Asia. This highly selective targeting strongly suggests a well-resourced threat actor with intelligence-driven objectives rather than opportunistic cybercrime.

Crucially, the Notepad++ source code itself was not compromised.

 

What Happened?

According to disclosures by the Notepad++ developer, the hosting provider, and independent security researchers:

  • From June 2025, attackers gained access to a shared hosting server used by Notepad++
  • The compromise occurred at the infrastructure level, not through a vulnerability in the Notepad++ codebase
  • Attackers were able to intercept and redirect update traffic destined for notepad-plus-plus.org
  • Selected users were redirected to attacker-controlled servers serving malicious update manifests
  • Other websites hosted on the same shared server were not targeted
  • Multiple security researchers assess the attackers as likely a Chinese state-sponsored group

The attackers specifically focused on Notepad++, likely due to their awareness of limitations in older versions of the updater’s integrity verification.

 

Why the Attack Worked

Older versions of the Notepad++ updater relied on insufficient verification of update authenticity and integrity. If an attacker could manipulate network traffic between a user and the update server, they could:

  • Alter update metadata
  • Redirect the updater to a malicious download location
  • Deliver and execute a malicious installer under the appearance of a legitimate update

Because this attack abused trusted software behavior, it was difficult to detect and may have bypassed traditional endpoint security controls.

 

Timeline of the Incident

Based on combined findings from the hosting provider and external security experts, the estimated timeline is:

  • June 2025 – Infrastructure compromise begins
  • June–September 2, 2025 – Full attacker access to the shared hosting server
  • September 2, 2025 – Kernel and firmware updates remove direct server access
  • September–December 2025 – Attackers retain credentials for internal services, enabling continued traffic redirection
  • November–December 2025 – Malicious activity ceases
  • December 2, 2025 – All credentials rotated and vulnerabilities patched
  • February 2, 2026 – Full public disclosure by Notepad++

While timelines differ slightly between investigators, all agree the compromise definitively ended in December 2025.

 

Remediation and Security Improvements

Following the incident, several corrective measures were implemented.

Infrastructure Changes

  • Migration away from shared hosting to a new hosting provider with stronger security practices
  • Rotation of all potentially exposed credentials
  • Additional infrastructure hardening

Notepad++ Updater Hardening

  • Certificate and signature verification of downloaded installers (v8.8.9)
  • Cryptographic signing of update XML manifests using XMLDSig
  • Mandatory enforcement of signature verification starting with v8.9.2

These changes significantly reduce the risk of future update-channel abuse.

 

Why This Matters Beyond Notepad++

This incident is a clear example of a software supply-chain attack. Rather than exploiting a flaw in the application itself, the attackers abused trusted delivery infrastructure.

There was no single CVE that captured this risk, yet the impact on targeted victims was real. Incidents like this challenge the assumption that the absence of a CVE means the absence of risk.

 

How BaseFortify Relates to This Incident

This incident does not map cleanly to a traditional CVE. There was no vulnerability in the Notepad++ code itself; the risk originated from a compromised update mechanism.

To provide context, such incidents can be conceptually represented using a pseudo-CPE, for example:

cpe:2.3:a:notepad-plus-plus:notepad++:update-mechanism:*:*:*:*:*:*

This does not imply the existence of a CVE. Instead, it highlights that the delivery channel, rather than the software component, was affected.

BaseFortify focuses on tracking software components and their known vulnerabilities, helping users understand where risk exists in their environment. Incidents like this underline why visibility into software usage remains essential, even when risks fall outside formal vulnerability databases.

Learn more or register at:

👉 https://basefortify.eu/register

 

Resources