The Notepad++ project yesterday disclosed that its update server was covertly hijacked in a targeted supply chain attack that began in June 2025, exposing a subset of users to malicious installers delivered through the editor’s built-in updater. According to Notepad++, attackers — which it claims were "likely a Chinese state-sponsored group" — gained the ability to selectively redirect update requests from specific users to attacker-controlled servers. Those victims were then served with a manipulated update manifest that pointed to a trojanized installer instead of the legitimate release.
Notepad++ says that this was “targeted”, with users “selectively redirected” to these attacker-controlled update manifests. As a result, users who manually downloaded installers from the official website were not affected, and most update requests continued to resolve normally. Instead, it appears as though the attackers intercepted traffic at the hosting layer used by the update service, enabling them to discriminate between targets in real-time.
