Notepad++ Updates Compromised for Months, Potentially Spying for China

Users of Notepad++ may have inadvertently installed a harmful update after the app’s hosting servers were compromised last year. Recently, the app’s developer, Don Ho, shared more information about the incident, indicating that the attackers were likely linked to a state-sponsored group from China. The servers were exposed to vulnerabilities for about six months, from June until December 2, 2025.

In his update, Ho explained that the breach occurred at the now-defunct hosting provider, where “Traffic from certain targeted users was selectively redirected to attacker-controlled servers with malicious update manifests.” This redirection allowed the hackers to replace legitimate app updates with a harmful executable, potentially granting them remote access to users’ keyboards, as noted by cybersecurity expert Kevin Beaumont.

Ho also mentioned that the attack was characterized by “highly selective targeting,” focusing on specific users rather than a broad audience. Beaumont pointed out that the victims he encountered were organizations with interests in East Asia, suggesting that the hackers were monitoring particular individuals.

While the developer did not disclose when the attack was first detected, he confirmed that “all attacker access was definitively terminated” by December 2nd. The Notepad++ updater has since been fortified with enhanced security measures to ensure updates are legitimate and free from tampering.

Users are advised to ensure they are running at least version 8.8.9, which addresses the vulnerabilities exploited during the attack, and to download this version directly from the official Notepad++ website. Beaumont also recommended that users verify they are not using unofficial versions of Notepad++, monitor the activity of “gup.exe,” the app’s updater, and check for any suspicious files like “update.exe” or “AutoUpdater.exe” in their TEMP folder.

Interestingly, Don Ho previously criticized the Chinese government in a 2019 update, branding that version the “Free Uyghur” edition, and mentioned that his website had faced DDoS attacks as a result.