Chinese Hackers Hijack Notepad++ Updates for 6 Months

A China-linked advanced persistent threat group compromised a third-party hosting provider to hijack Notepad++'s WinGUp updater from June–December 2025, selectively redirecting targeted users (notably East Asian telecom and financial organizations) to attacker-controlled servers that delivered malicious installers and a custom backdoor; Notepad++ has since migrated hosts and strengthened update verification.