Notepad++ update service was compromised

Multiple independent security investigations confirm that Notepad++’s update infrastructure was hijacked between June and December 2025. This was a supply-chain attack originating from a compromise at the hosting‑provider level, not from Notepad++’s code.

---

What exactly was compromised?

1. Update traffic was intercepted and redirected

Attackers manipulated the update endpoint (getDownloadUrl.php) so that some users requesting updates were silently redirected to malicious servers serving tampered executables.

2. It was targeted, not widespread

All sources emphasize that only specific users were affected, likely in an espionage‑focused campaign, not a mass malware distribution effort.

3. Hosting provider compromise, not a Notepad++ bug

The attackers gained access to the shared hosting environment, losing direct access in September 2025 but maintaining stolen internal service credentials through December 2, 2025.

---

Attribution: Likely Chinese state‑sponsored
threat actor

Across reports, independent security analysts consistently assess the perpetrator as a Chinese state‑linked group, due to both the targeting pattern and forensic evidence.

---

How Notepad++ responded

1. Migrated to a new, hardened hosting provider

2. Security improvements to the updater (WinGUp)

• v8.8.9 introduced certificate+signature verification.
• v8.9.2 will enforce XMLDSig and strict signature validation.
  

3. All hosting-provider credentials rotated

---

What YOU should do now

If you updated Notepad++ between June and December 2025, you may have received a malicious payload.
Recommended steps:

• Update immediately to at least v8.8.9 (or newer).
• Manually reinstall from the official site if unsure.
• Remove any self-signed certificates previously installed by older versions.
• Reset credentials for systems where a compromised update may have run (SSH, FTP, MySQL, etc.).