Notepad++ hijacked by suspected state-sponsored hackers

Notepad++'s update mechanism was hijacked from June to December 2025, with attackers intercepting and selectively redirecting update traffic to malicious servers; the developers and independent researchers assess the activity is likely linked to a Chinese state-sponsored actor. The compromise targeted the update delivery infrastructure (an on-path supply-chain attack), affected a subset of users, and prompted migration to a new host and security hardening in version 8.9.1.