Loading story…
Notepad++ released v8.9.2 to harden its update process after a state-linked intrusion enabled attackers to hijack update traffic and selectively deliver malware to targeted users. The new “double-lock” design adds cryptographic verification of the signed XML update metadata returned by notepad-plus-plus[.]org (via XMLDSig) and complements earlier protections (introduced in v8.8.9+) that verify the signed installer downloaded from GitHub. Additional security changes to the WinGUp auto-updater include removing libcurl.dll to reduce DLL side-loading risk, removing insecure cURL SSL options (CURLSSLOPT_ALLOW_BEAST, CURLSSLOPT_NO_REVOKE), and restricting plugin-management execution to binaries signed with the same certificate as WinGUp.
Reporting attributes the compromise to a China-linked actor (including Lotus Blossom) that abused a shared hosting provider-level breach to intercept and redirect update requests between June and December 2025, with selective victim targeting spanning government, telecom, and critical infrastructure—primarily in Southeast Asia but also affecting other regions. The campaign leveraged weaknesses in older WinGUp verification to deliver a malicious NSIS installer (update.exe) and execute follow-on payloads; described chains include a Lua script injection path delivering Cobalt Strike and another using DLL sideloading (including abuse of a legitimate Bitdefender component BluetoothService.exe to load a malicious log.dll) to deploy the Chrysalis backdoor. Notepad++ also fixed CVE-2026-25926 (CVSS 7.3), an unsafe search path issue that could allow arbitrary code execution by launching Windows Explorer without an absolute path, potentially enabling execution of a malicious explorer.exe if the working directory is attacker-controlled.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
Version 8.9.2 also patched CVE-2026-25926, a high-severity unsafe search path issue that could allow arbitrary code execution through abuse of how Windows Explorer is launched. This fix was included alongside the update-channel hardening.
On February 16, 2026, Notepad++ released version 8.9.2, adding XML digital signature verification for update metadata and combining it with signed installer validation. The release also hardened WinGUp by removing libcurl.dll, tightening TLS/SSL behavior, and restricting plugin-related execution to signed components.
In response to the compromise, Notepad++ released version 8.9.1 with stronger installer and update-response verification and moved to a new hosting provider. The project also announced plans for stricter update validation in the next release.
Security researchers including Rapid7, Kaspersky, and Palo Alto Networks linked the hijacked-update campaign to the China-linked espionage group Lotus Blossom, also referred to in some reporting as Lotus Panda. Their analysis tied the operation to the Chrysalis malware and the compromised update chain.
Notepad++'s disclosure said the hosting-provider-level breach and malicious redirection activity were detected in early December 2025. Reporting places the campaign's end around late 2025, with some sources citing November 10 and others December 2.
The selective update hijacking primarily affected targets in Southeast Asia, with additional victims later identified in South America, the United States, and Europe. The operation was described as targeted rather than mass exploitation.
During the campaign, tampered Notepad++ updates delivered multi-stage malware including Cobalt Strike Beacon and a previously undocumented backdoor called Chrysalis. One infection path used a malicious NSIS installer and DLL sideloading through a legitimate Bitdefender binary.
Notepad++ further strengthened update security in version 8.8.9 by verifying installer signatures and certificates. This reduced the risk of malicious binaries being accepted through the update process.
Before the final 2026 fixes, Notepad++ began hardening its updater in version 8.8.8 by addressing the previously unsigned XML update descriptor. This was an early step in securing the update channel after weaknesses were identified.
Beginning in June 2025, attackers compromised infrastructure at Notepad++'s hosting provider and started intercepting WinGUp update requests. They selectively redirected targeted users to attacker-controlled infrastructure serving malicious update content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
trustedsec.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcego.theregister.com
Open sourcehelpnetsecurity.com
Open sourcecsoonline.com
Open sourcecybersecuritynews.com
Open sourcenotepad-plus-plus.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the Notepad++ update mechanism, specifically within the WinGUp updater, allowed attackers to intercept and manipulate network traffic, redirecting update requests to malicious servers. This flaw enabled the silent installation of malware on user systems under the guise of legitimate software updates. Security researchers observed suspicious traffic patterns and confirmed that, in some cases, compromised binaries were delivered instead of genuine Notepad++ installers. The vulnerability stemmed from inadequate validation of the integrity and authenticity of downloaded update files, making it possible for attackers to exploit classic man-in-the-middle techniques and supply-chain attack vectors. In response, Notepad++ developers released an urgent update (v8.8.9) that strengthens the verification process for downloaded installers, now requiring strict digital signature and certificate checks before execution. If these checks fail, the update process is aborted to prevent the execution of untrusted code. The developer acknowledged that the investigation into the exact hijacking method is ongoing, but emphasized that the new security enhancements significantly reduce the risk of similar attacks. Users are advised to manually update to the latest version to ensure protection against this threat.
Jun 29, 2026
Notepad++ maintainers confirmed a **months-long compromise of the project’s former shared hosting/update infrastructure** that enabled a likely **Chinese state-sponsored** actor to selectively hijack update traffic and redirect targeted users to attacker-controlled servers hosting malicious payloads. The activity ran from **June 2025 to early December 2025** and was characterized as *highly selective* rather than broad “spray and pray” distribution, indicating a well-resourced adversary focused on specific victims. Investigations attributed the intrusion to an **infrastructure-level takeover** (compromise of the shared hosting environment) rather than a vulnerability in the Notepad++ codebase itself. The attacker-controlled redirection path included the updater’s `getDownloadUrl.php` endpoint and leveraged **insufficient update verification in older updater/Notepad++ versions** (prior to **v8.8.9**, including older *WinGUp* behavior) that did not strictly enforce certificate/signature validation for downloaded installers. Reporting also describes multiple phases of access during the incident window, with the hosting provider ultimately evicting the attacker by **Dec 2, 2025**.
Jun 29, 2026
Threat actors compromised **Notepad++** update infrastructure at the hosting-provider level and used it to redirect download/update traffic to attacker-controlled servers, enabling distribution of malicious updates to selected targets. Reporting described a multi-month intrusion window (mid-2025 through late 2025) in which attackers initially gained access to the shared hosting environment, then—after losing direct server access following maintenance—continued operating by leveraging retained valid credentials for internal services to keep redirecting requests from `https://notepad-plus-plus.org/getDownloadUrl.php` to malicious infrastructure. Technical reporting described **three distinct infection chains** observed during the operation, with targeting across government, financial, and IT sectors in multiple countries (including Vietnam, El Salvador, Australia, and the Philippines). The activity included abuse of legitimate software (e.g., *ProShow*), malicious Lua scripts, and deployment of the **Chrysalis backdoor**; CERT-EU’s February 2026 cyber brief also highlighted the incident as a **Notepad++ supply-chain compromise** attributed in open reporting to the China-linked group **Lotus Blossom**.
Jun 29, 2026