Supply Chain Attack Abused Notepad++ Update Infrastructure to Deliver Targeted Malware

A sophisticated supply-chain campaign compromised Notepad++'s update mechanism (June–Dec 2025), enabling attackers to distribute malicious NSIS installers that executed reconnaissance, downloaded Metasploit/Cobalt Strike payloads, and ultimately deployed a custom Chrysalis backdoor; the intrusion impacted a limited set of individual and organizational victims across multiple countries and featured rotated C2 infrastructure and multiple infection chains, while security vendors successfully blocked observed activity.