Supply Chain Attack Exploits Notepad++ Update Mechanism to Push Targeted Malware

Notepad++'s update infrastructure was compromised in a prolonged supply-chain campaign (June–Dec 2025) that pushed malicious Notepad++ updates across three distinct infection chains—delivering NSIS installers, Metasploit/Cobalt Strike downloaders, and the Chrysalis espionage backdoor—to individuals and organizations in multiple countries; attackers rotated C2, downloaders, and payloads frequently, maintained access to internal services for months, and were analyzed/blocked by Kaspersky, which provided IOCs and hunting recommendations.