Loading signal...
Signal
Submitted
Feb 2, 2026, 18:41 UTC
Notepad++ update servers were hijacked from June to December 2025 by likely Chinese state-sponsored hackers redirecting update traffic to malicious servers. Full remediation finished by December 2, 2025.
An investigation into Notepad++ update infrastructure compromise found that from June 2025, a shared hosting server was breached by a threat actor believed to be a Chinese state-sponsored group, enabling interception and redirection of Notepad++ update traffic. Although server access was lost on September 2, 2025, attackers maintained credentials until December 2, 2025, continuing malicious update redirection. These attacks exploited older insufficient update verification methods in Notepad++. The hosting provider undertook remediation and security hardening, fully terminating attacker access by December 2. Notepad++ subsequently migrated to a new hosting provider with enhanced security, strengthened update verification via WinGup in v8.8.9, and plans to enforce signature validation with upcoming v8.9.2. Users are urged to update to v8.9.1 to apply security enhancements. The developer apologizes for user impact and considers the issue resolved.
Confidence: High
The event is clearly an aggressor activity involving a state-sponsored compromise of update infrastructure by likely Chinese hackers. It details hostile cyber intrusion and redirection of software updates. The defense aspect is present in remediation and security enhancements, including migration and update verification improvements, qualifying for defense preparation as well.
Source URL
https://notepad-plus-plus.org/news/hijacked-incident-info-update
Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "a5744a0a-6928-4374-aa29-1172dc552d8a",
"url": "https://notepad-plus-plus.org/news/hijacked-incident-info-update",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Unknown",
"source_reliability": "A",
"info_credibility": "2",
"tags": [
"Notepad++",
"software supply chain attack",
"Chinese state-sponsored hackers",
"cyber intrusion",
"update hijacking",
"infrastructure compromise",
"security hardening",
"WinGup updater",
"certificate verification",
"manual update recommendation"
],
"nodes": [],
"countries": [],
"where_text": "Cyberspace",
"headline": "Notepad++ Hijacked by State-Sponsored Hackers",
"description": "Following a security disclosure in the Notepad++ v8.8.9 release, an investigation revealed that the Notepad++ update infrastructure was compromised by a likely Chinese state-sponsored threat actor. Starting in June 2025, attackers performed an infrastructure-level compromise at the shared hosting provider, allowing malicious interception and redirection of update traffic for notepad-plus-plus.org. Despite losing direct access on September 2, 2025, the attackers retained internal service credentials until December 2, 2025, enabling continued redirection to malicious update servers. The overall compromise period lasted from June through December 2, 2025, until full remediation was completed. The attack exploited insufficient update verification in older Notepad++ versions. The Notepad++ website migrated to a new, more secure hosting provider, and the updater WinGup in v8.8.9 was enhanced to verify download certificates and signatures, with enforced signature verification to start in v8.9.2. The author strongly recommends users download v8.9.1 for security improvements and manually update their software.",
"summary_short": "Notepad++ update servers were hijacked from June to December 2025 by likely Chinese state-sponsored hackers redirecting update traffic to malicious servers. Full remediation finished by December 2, 2025.",
"summary_extended": "An investigation into Notepad++ update infrastructure compromise found that from June 2025, a shared hosting server was breached by a threat actor believed to be a Chinese state-sponsored group, enabling interception and redirection of Notepad++ update traffic. Although server access was lost on September 2, 2025, attackers maintained credentials until December 2, 2025, continuing malicious update redirection. These attacks exploited older insufficient update verification methods in Notepad++. The hosting provider undertook remediation and security hardening, fully terminating attacker access by December 2. Notepad++ subsequently migrated to a new hosting provider with enhanced security, strengthened update verification via WinGup in v8.8.9, and plans to enforce signature validation with upcoming v8.9.2. Users are urged to update to v8.9.1 to apply security enhancements. The developer apologizes for user impact and considers the issue resolved.",
"actor_primary": null,
"target_primary": null,
"location_text": "Notepad++ update infrastructure (shared hosting server for notepad-plus-plus.org)",
"location_region": null,
"location_coordinates_lat": null,
"location_coordinates_lon": null,
"location_precision": "Approximate",
"is_aggressor_signal": true,
"signal_type": "DEFENSE_PREP_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The event is clearly an aggressor activity involving a state-sponsored compromise of update infrastructure by likely Chinese hackers. It details hostile cyber intrusion and redirection of software updates. The defense aspect is present in remediation and security enhancements, including migration and update verification improvements, qualifying for defense preparation as well.",
"event_time_utc": "2026-02-02T00:00:00.000Z",
"end_time_utc": "2025-12-02T00:00:00.000Z",
"event_time_confidence": "pm24h",
"created_at": "2026-02-02T18:41:00.031Z",
"updated_at": "2026-11-09T06:58:21.434Z",
"reliability_band": "strong",
"location_precision_band": "approximate",
"time_precision_band": "within_24h",
"severity_band": "moderate",
"attribution_confidence_band": "medium",
"attribution_basis": "single_source"
}Source reliability
A
Info credibility
2
Event time
Feb 2, 2026, 00:00 UTC
End time
Dec 2, 2025, 00:00 UTC
Event time confidence
pm24h
Location
Notepad++ update infrastructure (shared hosting server for notepad-plus-plus.org)
Country
Unknown
Tags
Notepad++, software supply chain attack, Chinese state-sponsored hackers, cyber intrusion, update hijacking, infrastructure compromise, security hardening, WinGup updater, certificate verification, manual update recommendation
Signal
Submitted
Feb 2, 2026, 18:41 UTC
Notepad++ update servers were hijacked from June to December 2025 by likely Chinese state-sponsored hackers redirecting update traffic to malicious servers. Full remediation finished by December 2, 2025.
An investigation into Notepad++ update infrastructure compromise found that from June 2025, a shared hosting server was breached by a threat actor believed to be a Chinese state-sponsored group, enabling interception and redirection of Notepad++ update traffic. Although server access was lost on September 2, 2025, attackers maintained credentials until December 2, 2025, continuing malicious update redirection. These attacks exploited older insufficient update verification methods in Notepad++. The hosting provider undertook remediation and security hardening, fully terminating attacker access by December 2. Notepad++ subsequently migrated to a new hosting provider with enhanced security, strengthened update verification via WinGup in v8.8.9, and plans to enforce signature validation with upcoming v8.9.2. Users are urged to update to v8.9.1 to apply security enhancements. The developer apologizes for user impact and considers the issue resolved.
Confidence: High
The event is clearly an aggressor activity involving a state-sponsored compromise of update infrastructure by likely Chinese hackers. It details hostile cyber intrusion and redirection of software updates. The defense aspect is present in remediation and security enhancements, including migration and update verification improvements, qualifying for defense preparation as well.
Source URL
https://notepad-plus-plus.org/news/hijacked-incident-info-update
Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "a5744a0a-6928-4374-aa29-1172dc552d8a",
"url": "https://notepad-plus-plus.org/news/hijacked-incident-info-update",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Unknown",
"source_reliability": "A",
"info_credibility": "2",
"tags": [
"Notepad++",
"software supply chain attack",
"Chinese state-sponsored hackers",
"cyber intrusion",
"update hijacking",
"infrastructure compromise",
"security hardening",
"WinGup updater",
"certificate verification",
"manual update recommendation"
],
"nodes": [],
"countries": [],
"where_text": "Cyberspace",
"headline": "Notepad++ Hijacked by State-Sponsored Hackers",
"description": "Following a security disclosure in the Notepad++ v8.8.9 release, an investigation revealed that the Notepad++ update infrastructure was compromised by a likely Chinese state-sponsored threat actor. Starting in June 2025, attackers performed an infrastructure-level compromise at the shared hosting provider, allowing malicious interception and redirection of update traffic for notepad-plus-plus.org. Despite losing direct access on September 2, 2025, the attackers retained internal service credentials until December 2, 2025, enabling continued redirection to malicious update servers. The overall compromise period lasted from June through December 2, 2025, until full remediation was completed. The attack exploited insufficient update verification in older Notepad++ versions. The Notepad++ website migrated to a new, more secure hosting provider, and the updater WinGup in v8.8.9 was enhanced to verify download certificates and signatures, with enforced signature verification to start in v8.9.2. The author strongly recommends users download v8.9.1 for security improvements and manually update their software.",
"summary_short": "Notepad++ update servers were hijacked from June to December 2025 by likely Chinese state-sponsored hackers redirecting update traffic to malicious servers. Full remediation finished by December 2, 2025.",
"summary_extended": "An investigation into Notepad++ update infrastructure compromise found that from June 2025, a shared hosting server was breached by a threat actor believed to be a Chinese state-sponsored group, enabling interception and redirection of Notepad++ update traffic. Although server access was lost on September 2, 2025, attackers maintained credentials until December 2, 2025, continuing malicious update redirection. These attacks exploited older insufficient update verification methods in Notepad++. The hosting provider undertook remediation and security hardening, fully terminating attacker access by December 2. Notepad++ subsequently migrated to a new hosting provider with enhanced security, strengthened update verification via WinGup in v8.8.9, and plans to enforce signature validation with upcoming v8.9.2. Users are urged to update to v8.9.1 to apply security enhancements. The developer apologizes for user impact and considers the issue resolved.",
"actor_primary": null,
"target_primary": null,
"location_text": "Notepad++ update infrastructure (shared hosting server for notepad-plus-plus.org)",
"location_region": null,
"location_coordinates_lat": null,
"location_coordinates_lon": null,
"location_precision": "Approximate",
"is_aggressor_signal": true,
"signal_type": "DEFENSE_PREP_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The event is clearly an aggressor activity involving a state-sponsored compromise of update infrastructure by likely Chinese hackers. It details hostile cyber intrusion and redirection of software updates. The defense aspect is present in remediation and security enhancements, including migration and update verification improvements, qualifying for defense preparation as well.",
"event_time_utc": "2026-02-02T00:00:00.000Z",
"end_time_utc": "2025-12-02T00:00:00.000Z",
"event_time_confidence": "pm24h",
"created_at": "2026-02-02T18:41:00.031Z",
"updated_at": "2026-11-09T06:58:21.434Z",
"reliability_band": "strong",
"location_precision_band": "approximate",
"time_precision_band": "within_24h",
"severity_band": "moderate",
"attribution_confidence_band": "medium",
"attribution_basis": "single_source"
}Source reliability
A
Info credibility
2
Event time
Feb 2, 2026, 00:00 UTC
End time
Dec 2, 2025, 00:00 UTC
Event time confidence
pm24h
Location
Notepad++ update infrastructure (shared hosting server for notepad-plus-plus.org)
Country
Unknown
Tags
Notepad++, software supply chain attack, Chinese state-sponsored hackers, cyber intrusion, update hijacking, infrastructure compromise, security hardening, WinGup updater, certificate verification, manual update recommendation