NOTEPAD++ HIJACKED BY STATE-SPONSORED HACKERS

Summary from the TLDR InfoSec newsletter

Notepad++ confirmed that a suspected Chinese state-sponsored group compromised its shared hosting provider from June through December 2025, selectively redirecting update traffic to serve malicious installers by exploiting insufficient update verification controls. The attackers maintained persistent access through stolen internal service credentials even after losing direct server access in September 2025. Notepad++ has since migrated hosting providers and hardened its update mechanism with certificate and signature verification in v8.8.9, with full XMLDSig enforcement expected in v8.9.2.