Loading story…
A critical vulnerability in the Notepad++ update mechanism, specifically within the WinGUp updater, allowed attackers to intercept and manipulate network traffic, redirecting update requests to malicious servers. This flaw enabled the silent installation of malware on user systems under the guise of legitimate software updates. Security researchers observed suspicious traffic patterns and confirmed that, in some cases, compromised binaries were delivered instead of genuine Notepad++ installers. The vulnerability stemmed from inadequate validation of the integrity and authenticity of downloaded update files, making it possible for attackers to exploit classic man-in-the-middle techniques and supply-chain attack vectors.
In response, Notepad++ developers released an urgent update (v8.8.9) that strengthens the verification process for downloaded installers, now requiring strict digital signature and certificate checks before execution. If these checks fail, the update process is aborted to prevent the execution of untrusted code. The developer acknowledged that the investigation into the exact hijacking method is ongoing, but emphasized that the new security enhancements significantly reduce the risk of similar attacks. Users are advised to manually update to the latest version to ensure protection against this threat.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
After the fixes were released, reporting said the precise mechanism used to redirect or intercept update traffic remained under investigation, with ISP-level interception among the suspected possibilities. Users were advised to download updates only from the official Notepad++ site and watch for indicators such as gup.exe contacting unauthorized domains or spawning unusual processes.
Notepad++ released version 8.8.9 to fix the updater weakness by enforcing stricter digital-signature and certificate verification for installers. The project also advised users to upgrade immediately and remove any previously installed custom Notepad++ root certificates.
Public reporting revealed that the WinGUp updater did not adequately verify the integrity and authenticity of downloaded update files, allowing man-in-the-middle or traffic-hijacking attacks to replace legitimate updates with malware. Reports also noted risks tied to weak file authentication and use of a self-signed root certificate.
As an initial mitigation, the Notepad++ developer changed the update process in version 8.8.8 so updates would be downloaded only from GitHub, reducing opportunities for traffic interception and malicious file substitution. This was described as an early response while the full issue was still under investigation.
The issue first came to light when a user observed the WinGUp updater spawning a suspicious executable that conducted reconnaissance and exfiltrated system information instead of performing a normal update. This report helped identify that the update mechanism was being abused in the wild.
At least three organizations with interests in East Asia, including telecom and finance targets, were reportedly compromised after attackers hijacked the Notepad++ update process to deliver malicious executables. Security reporting linked the activity to highly targeted intrusions, with some evidence suggesting Chinese threat actors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourceheise.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Notepad++ released **v8.9.2** to harden its update process after a state-linked intrusion enabled attackers to **hijack update traffic** and selectively deliver malware to targeted users. The new “**double-lock**” design adds cryptographic verification of the **signed XML** update metadata returned by `notepad-plus-plus[.]org` (via **XMLDSig**) and complements earlier protections (introduced in **v8.8.9+**) that verify the **signed installer** downloaded from GitHub. Additional security changes to the *WinGUp* auto-updater include removing `libcurl.dll` to reduce DLL side-loading risk, removing insecure cURL SSL options (`CURLSSLOPT_ALLOW_BEAST`, `CURLSSLOPT_NO_REVOKE`), and restricting plugin-management execution to binaries signed with the same certificate as WinGUp. Reporting attributes the compromise to a China-linked actor (including **Lotus Blossom**) that abused a **shared hosting provider-level breach** to intercept and redirect update requests between **June and December 2025**, with selective victim targeting spanning government, telecom, and critical infrastructure—primarily in Southeast Asia but also affecting other regions. The campaign leveraged weaknesses in older WinGUp verification to deliver a malicious **NSIS** installer (`update.exe`) and execute follow-on payloads; described chains include a Lua script injection path delivering **Cobalt Strike** and another using **DLL sideloading** (including abuse of a legitimate Bitdefender component `BluetoothService.exe` to load a malicious `log.dll`) to deploy the **Chrysalis** backdoor. Notepad++ also fixed **CVE-2026-25926** (CVSS 7.3), an **unsafe search path** issue that could allow arbitrary code execution by launching Windows Explorer without an absolute path, potentially enabling execution of a malicious `explorer.exe` if the working directory is attacker-controlled.
Jun 29, 2026
Notepad++ maintainers confirmed a **months-long compromise of the project’s former shared hosting/update infrastructure** that enabled a likely **Chinese state-sponsored** actor to selectively hijack update traffic and redirect targeted users to attacker-controlled servers hosting malicious payloads. The activity ran from **June 2025 to early December 2025** and was characterized as *highly selective* rather than broad “spray and pray” distribution, indicating a well-resourced adversary focused on specific victims. Investigations attributed the intrusion to an **infrastructure-level takeover** (compromise of the shared hosting environment) rather than a vulnerability in the Notepad++ codebase itself. The attacker-controlled redirection path included the updater’s `getDownloadUrl.php` endpoint and leveraged **insufficient update verification in older updater/Notepad++ versions** (prior to **v8.8.9**, including older *WinGUp* behavior) that did not strictly enforce certificate/signature validation for downloaded installers. Reporting also describes multiple phases of access during the incident window, with the hosting provider ultimately evicting the attacker by **Dec 2, 2025**.
Jun 29, 2026
Notepad++ released version **8.9.7** with fixes for five security vulnerabilities, including a critical installer-based flaw that could allow **PowerShell command injection** and arbitrary code execution. Reported issues also include a stack buffer overflow, a **Zip Slip** path traversal vulnerability in the `WinGUp` updater, a `session.xml` path validation bypass, and a `shortcuts.xml` macro HMAC integrity bypass. The weaknesses could be exploited through tampered installers, malicious local configuration files, or abuse of update extraction to overwrite files, corrupt memory, bypass protections, or fully compromise a system. The Canadian Centre for Cyber Security issued advisory **AV26-703**, warning that vulnerabilities affect **Notepad++ versions prior to 9.7** and urging users and administrators to review the vendor guidance and apply updates. The notice points to the Notepad++ security advisory and release resources for remediation, while reporting indicates users should update manually rather than wait for the staged auto-updater rollout.
Jul 17, 2026