Notepad++ Hijacked by State-Sponsored Hackers

[Picuino]

https://notepad-plus-plus.org/news/hijacked-incident-info-update/
It appears that there has been a serious security breach in the text editor.

[golden_labels]

Software	Attack method	Ref.
Notepad++	Breached software supply chain	Announcement
Notepad	Breached text file supply chain	CVE-2026-20841

[magic]

What sort of commands exist in notepad?

Did it get AI features in Windows 11?

[abeyer]

What sort of commands exist in notepad?

Did it get AI features in Windows 11?

This is about Notepad++, a totally different third-party programming editor.

But the original notepad did in fact get a bunch of junk added in win 11, too, and also had a different security issue due to that.

[golden_labels]

What sort of commands exist in notepad?

Passing unchecked links from Markdown files to external programs.

This is about Notepad++, a totally different third-party programming editor.

See the post to which magic was replying.

[abeyer]

See the post to which magic was replying.

Yes, I see, and was pointing out that's a totally different thing, as it somewhat non-obviously introduced a totally separate but confusingly similar to the thread without being clear that it did.

[floobydust]

"Notepad++ itself was NOT hacked. The issue was with the auto-updater component (WinGup), which was exploited through a compromise of our former hosting provider’s infrastructure. The Notepad++ application you’ve been using remains safe and secure."

"This was a highly selective attack by a state-sponsored group targeting specific high-value organizations. Security researchers confirmed that the vast majority of Notepad++ users were never affected - attackers filtered victims based on strategic value, not random distribution."

"For most users: Simply updating to the latest version is sufficient."

from https://notepad-plus-plus.org/news/clarification-security-incident/

[The Soulman]

Pardon my ignorance, please clarify "state-sponsored". 

[helius]

The term of art refers to national intelligence agencies and their assets.

[abeyer]

The general background is that the notepad++ hack exploited weaknesses in the auto-update system it used. The attackers got access to the servers/infrastructure used to distribute the updates and sent malicious files instead of the real update to some users when they tried to update.

According to the hosting provider that owned/operated those servers, they had evidence that the attacker who got access to them was a group affiliated with or sponsored by some government. However, to my knowledge they never explicitly said what government nor what the evidence was that led to the conclusion.

[Simmed]

https://notepad-plus-plus.org/news/hijacked-incident-info-update/

The incident began in June 2025. Multiple independent security researchers have assessed that the threat actor is likely a Chinese state-sponsored group, which would explain the highly selective targeting observed during the campaign.

According to the former hosting provider, the shared hosting server was compromised until September 2, 2025. Even after losing server access, attackers maintained credentials to internal services until December 2, 2025, which allowed them to continue redirecting Notepad++ update traffic to malicious servers. The attackers specifically targeted the Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++. All remediation and security hardening was completed by the provider by December 2, 2025, successfully blocking further attacker activity.

Note on timelines: The security expert’s analysis indicates the attack ceased on November 10, 2025, while the hosting provider’s statement shows potential attacker access until December 2, 2025. Based on both assessments, I estimate the overall compromise period spanned from June through December 2, 2025, when all attacker access was definitively terminated.

To address this severe security issue, the Notepad++ website has been migrated to a new hosting provider with significantly stronger security practices.
Within Notepad++ itself, WinGup (the updater) was enhanced in v8.8.9 to verify both the certificate and the signature of the downloaded installer. Additionally, the XML returned by the update server is now signed (XMLDSig), and the certificate & signature verification will be enforced starting with upcoming v8.9.2, expected in about one month.

i hate auto updates
it is annoying like flies


https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

Analysis of “update.exe” shows the file is actually an NSIS installer, a tool commonly used by Chinese APT to deliver initial payload.

Following data encryption, the malware establishes an internet connection using previously mentioned user agent and C2 api.skycloudcenter.com over port 443. Data is then transferred via HttpSendRequestA using the POST method. Response from the server is then read to a temporary buffer which is later decrypted using the same key vAuig34%^325hGV.

Conclusion

The discovery of the Chrysalis backdoor and the Warbird loader highlights an evolution in Lotus Blossom's capabilities. While the group continues to rely on proven techniques like DLL sideloading and service persistence, their multi-layered shellcode loader and integration of undocumented system calls (NtQuerySystemInformation) mark a clear shift toward more resilient and stealth tradecraft.

What stands out is the mix of tools: the deployment of custom malware (Chrysalis) alongside commodity frameworks like Metasploit and Cobalt Strike, together with the rapid adaptation of public research (specifically the abuse of Microsoft Warbird). This demonstrates that Lotus Blossom is actively updating their playbook to stay ahead of modern detection.

[m k]

What are easy history checks for average Joe?
Can't find any easy logs.

I think I updated it last spring, but manually, auto update failed, maybe because old version was too old.
Can't find the updated version number either, I think it was 8.8.8, but can't find the package anymore.
Browser has history, but it's updated by this new update.