Loading story…
Notepad++ confirmed that its website and update distribution path were compromised, enabling a supply-chain attack that delivered malicious payloads to some users. Reporting and follow-on analysis tied the activity to infrastructure associated with the Chinese espionage group Lotus Blossom, with researchers describing a campaign that abused trusted software delivery to gain initial access and establish persistence on victim systems.
Censys and other researchers mapped malicious network infrastructure used in the operation, while incident-response guidance and public triage tooling were released to help defenders identify affected hosts and hunt for indicators of compromise. Analysis from multiple firms said the intrusion appears to have run for months in 2025, raising concern that organizations using Notepad++ should review update activity, inspect outbound connections to known attacker infrastructure, and validate whether developer or hosting environments were tampered with.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On February 10, 2026, LevelBlue released a technical analysis of the Notepad++ supply-chain compromise. The write-up further documented the incident and its mechanics for defenders and incident responders.
On February 4, 2026, a GitHub repository published a PowerShell triage script to help defenders detect indicators of compromise related to the Notepad++ supply-chain attack. The tool explicitly referenced Lotus Blossom and the June-November 2025 campaign window.
On February 3, 2026, Censys released research detailing the network infrastructure associated with the malicious Notepad++ activity. The publication added technical visibility into the infrastructure supporting the campaign.
Security reporting on February 2, 2026 attributed the Notepad++ hijacking and supply-chain activity to the Chinese Lotus Blossom threat group. This attribution became a key development in understanding the incident.
On February 2, 2026, public reporting and social media posts stated that Notepad++ had confirmed the compromise affecting its software distribution. This was the first clear public acknowledgment reflected in the provided references.
The known period of malicious Notepad++ distribution concluded in November 2025, ending the campaign window described by later researchers. This marks the latest inferred date for users receiving trojanized installers from the compromised infrastructure.
Between June and November 2025, trojanized Notepad++ downloads were served to victims, constituting a supply-chain attack. Reporting and later triage guidance tie this activity to Lotus Blossom and indicate users who downloaded during this window may have been exposed.
Threat actors linked to Lotus Blossom compromised infrastructure used to distribute Notepad++ software, turning the project’s hosting environment into a malicious delivery channel. Multiple later analyses describe this as the root cause of the supply-chain incident.
6 references tracked. Mallory keeps watching after this page renders.
levelblue.com
Open sourcegithub.com
Open sourcecensys.com
Open sourceforrester.com
Open sourcecyberplace.social
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors compromised **Notepad++** update infrastructure at the hosting-provider level and used it to redirect download/update traffic to attacker-controlled servers, enabling distribution of malicious updates to selected targets. Reporting described a multi-month intrusion window (mid-2025 through late 2025) in which attackers initially gained access to the shared hosting environment, then—after losing direct server access following maintenance—continued operating by leveraging retained valid credentials for internal services to keep redirecting requests from `https://notepad-plus-plus.org/getDownloadUrl.php` to malicious infrastructure. Technical reporting described **three distinct infection chains** observed during the operation, with targeting across government, financial, and IT sectors in multiple countries (including Vietnam, El Salvador, Australia, and the Philippines). The activity included abuse of legitimate software (e.g., *ProShow*), malicious Lua scripts, and deployment of the **Chrysalis backdoor**; CERT-EU’s February 2026 cyber brief also highlighted the incident as a **Notepad++ supply-chain compromise** attributed in open reporting to the China-linked group **Lotus Blossom**.
Jun 29, 2026
Rapid7 Labs and the Rapid7 MDR team reported a targeted espionage campaign attributed to the **Chinese APT group Lotus Blossom**, in which attackers **compromised infrastructure used to distribute Notepad++** and leveraged it to deliver a previously undocumented backdoor dubbed **Chrysalis**. Victimology described in the reporting includes government, telecom, aviation, media, and other **critical infrastructure** organizations, with activity historically concentrated in Southeast Asia and later observed in Central America. The intrusion chain observed on affected hosts included execution of `notepad++.exe` and `GUP.exe` followed by a suspicious `update.exe` downloaded from `95.179.213.0`, consistent with abuse of the Notepad++ distribution channel; Rapid7 noted that while prior public reporting referenced plugin replacement and updater-related mechanisms, their forensics did not confirm a specific sub-mechanism beyond the observed execution sequence. Technical analysis described **NSIS installer-based delivery**, **DLL sideloading**, and multiple custom loaders, including a notable loader sample (“`ConsoleApplication2.exe`”) that used **Microsoft Warbird** code-protection to obscure shellcode execution, alongside custom API-hashing and obfuscation. Rapid7 indicated the reporting includes actionable **IOCs** to support detection and response. Separate reporting on **Pulsar RAT** describes a different Windows malware campaign (persistence via `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, PowerShell loaders, Donut shellcode injection, and Discord webhook exfiltration) and does not appear connected to the Notepad++/Chrysalis activity.
Jun 29, 2026
Notepad++ maintainers confirmed a **months-long compromise of the project’s former shared hosting/update infrastructure** that enabled a likely **Chinese state-sponsored** actor to selectively hijack update traffic and redirect targeted users to attacker-controlled servers hosting malicious payloads. The activity ran from **June 2025 to early December 2025** and was characterized as *highly selective* rather than broad “spray and pray” distribution, indicating a well-resourced adversary focused on specific victims. Investigations attributed the intrusion to an **infrastructure-level takeover** (compromise of the shared hosting environment) rather than a vulnerability in the Notepad++ codebase itself. The attacker-controlled redirection path included the updater’s `getDownloadUrl.php` endpoint and leveraged **insufficient update verification in older updater/Notepad++ versions** (prior to **v8.8.9**, including older *WinGUp* behavior) that did not strictly enforce certificate/signature validation for downloaded installers. Reporting also describes multiple phases of access during the incident window, with the hosting provider ultimately evicting the attacker by **Dec 2, 2025**.
Jun 29, 2026