Notepad++ Official Update Mechanism Hijacked to Deliver Malware to Select Users

Notepad++'s update infrastructure was compromised at the hosting-provider level, allowing state-sponsored actors (attributed to Violet Typhoon/APT31) to intercept and redirect selective update traffic to malicious servers and deliver poisoned executables. The campaign, active from around June 2025 and persisting through credential retention into December 2025, targeted telecommunications and financial organizations in East Asia; Notepad++ has migrated hosting and hardened its updater to remediate the issue.