Notepad++ Hijacked: State-Sponsored Actors Poisoned Updates for Months

Notepad++ disclosed a sustained infrastructure-level compromise (June–December 2025) in which attackers who likely belong to a Chinese state-sponsored group hijacked its hosting provider to intercept and redirect update traffic and deliver malicious installers selectively to specific targets; the project migrated hosting and overhauled its WinGup updater (v8.8.9) to add certificate/signature verification and XMLDSig for update manifests, and urges users to update immediately.