notepad++ update channel hijacked via its hosting provider
Attackers who compromised Notepad++'s former hosting provider quietly redirected selected users' update requests to malicious installers for months before the project disclosed it.
- affected
- Notepad++ installs updating via WinGUp from June to 2 December 2025 (selected users only)
- fixed in
- v8.8.9 (installer certificate and signature checks); project recommends v8.9.1
- exploited
- yes — targeted malicious updates delivered to selected users
what happened
- On 2 February 2026, following an earlier disclosure in its v8.8.9 announcement, Notepad++ said attackers had hijacked its update traffic through a compromise at its former shared hosting provider, not through vulnerabilities in Notepad++ code itself.[1]
- Only selected users' update requests were redirected to attacker-controlled update manifests.[1]
- The compromise began in June 2025; the provider says the server was compromised until 2 September 2025 and attackers kept credentials for internal services until 2 December 2025.[1]
- Help Net Security reports that before v8.8.8 the WinGUp updater could be made to download updates from sources other than GitHub, and before v8.8.9 it did not validate the downloaded file's integrity or authenticity.[2]
- Notepad++ v8.8.9 added certificate and signature verification for the downloaded installer, and the project recommended manually installing v8.9.1.[1]
- Researcher Kevin Beaumont said the targeted organisations were telecommunications and financial services organisations in East Asia, and advised checking for gup.exe making network requests to hosts other than notepad-plus-plus.org, github.com and release-assets.githubusercontent.com.[2]
- Notepad++ said multiple independent security researchers assessed the attacker as likely a Chinese state-sponsored group.[1,3]
where sources differNamed-group attribution differs: Rapid7 links the campaign to Lotus Blossom with moderate confidence (per The Register), Kevin Beaumont attributes it to Zirconium/Violet Typhoon (per Help Net Security), and the maintainer said he could not confirm the attribution. A security expert's analysis cited by Notepad++ puts the attack's end at 10 November 2025, while the hosting provider reports credential access until 2 December 2025.
sources3
- 01Notepad++ Hijacked by State-Sponsored Hackers ↗ primaryNotepad++accessed 2026-10-21
- 02How state-sponsored attackers hijacked Notepad++ updates ↗ secondaryHelp Net Securityaccessed 2026-10-21
- 03Notepad++ hijacking blamed on Chinese Lotus Blossom crew behind Chrysalis backdoor ↗ secondaryThe Registeraccessed 2026-10-21