Notepad++ Updates Delivered Malware After Hosting Provider Breach

Notepad++'s update infrastructure was compromised through its former hosting provider, allowing attackers to intercept update requests and redirect some users to servers delivering malicious installers from June through at least November 2025. The compromise focused on the notepad-plus-plus.org domain, exhibited selective, persistent behavior consistent with an APT, and prompted migration to a new host plus enhanced client-side verification (signature and XML digital signatures) to mitigate future hijacks.