US EditionNotepad++ Confirms State-Sponsored Hackers Hijacked Updates
- On Monday, Notepad++ maintainer Don Ho said suspected Chinese state-sponsored attackers hijacked the update mechanism by redirecting some users to malicious update servers.
- Investigators reported the intrusion started in June 2025, and attackers retained internal credentials until December 2, despite a temporary loss in early September.
- Security researcher Kevin Beaumont said at least three organizations with East Asia interests faced targeted Notepad++ update hijacks, leading to hands-on keyboard intrusions.
- Notepad++ migrated hosting, rotated credentials, patched vulnerabilities, and confirmed malicious activity stopped; version 8.8.9 added signature verification and version 8.9 removed the self-signed root certificate, which users were urged to remove.
- With broad attention, researchers and reporters continue to investigate Notepad++, which has tens of millions of users, drawing scrutiny from CISA and media like The Register; Kevin Beaumont praised the developer.
49 Articles
49 Articles
Notepad++ says it was hijacked by Chinese state-sponsored hackers
Last year, the creator of Notepad++ rolled out an update for the text and source code editor after security experts reported that bad actors were hijacking its update mechanism to redirect traffic to malicious servers. It led to users downloading compromised executables that could infect their devices. Now, Don Ho has revealed that multiple security experts investigated the breach and determined that the threat actor “is likely a Chinese state-s…
The known Notepad++ suffered a cyberattack that put its users at risk for months. Vulnerability is not new, since the application programmers have already announced it in December. However,...
Open-source coding app Notepad++ targeted in Chinese-linked supply-chain attack
A Chinese-linked cyberespionage group with a long history hijacked the update process for the popular code editing platform Notepad++ to deliver a custom backdoor and other malware to targeted users, the program’s developer and cybersecurity researchers said on Monday, February 2. Don Ho, the French-based developer of Notepad++, said in a blog posted to the project’s website on Monday that “malicious actors” had targeted the update process for “…
China-based espionage group compromised Notepad++ for six months
A China-based threat group operating for almost two decades broke into the internal systems of Notepad++, an extremely popular open source-code editor, to spy on a select group of targeted users, researchers at Rapid7 said Monday. Don Ho, the author and maintainer of the open-source tool, said independent security researchers confirmed a China state-sponsored group compromised Notepad++’s server for a six-month period starting in June 2025. Ho, …
Notepad++ updates got hijacked for months and could have spied for China
Users of the text and code editor Notepad++ may have unknowingly downloaded a malicious update for the app after its shared hosting servers were hijacked last year. On Monday, the app's developer, Don Ho, posted an update on the attack with more details, including that the hackers were "likely a Chinese state-sponsored group" and that the app's servers were vulnerable for roughly six months from June through December 2nd, 2025. The post explains…
Coverage Details
Bias Distribution
- 59% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
