Notepad++ Official Update Mechanism Hijacked to Deliver Malware to Select Users
February 2nd, 2026Microsoft bad.
Think outside the box.
Turns out, there’s always another box.
Via: The Hacker News:
The maintainer of Notepad++ has revealed that state-sponsored attackers hijacked the utility’s update mechanism to redirect update traffic to malicious servers instead.
“The attack involved [an] infrastructure-level compromise that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org,” developer Don Ho said. “The compromise occurred at the hosting provider level rather than through vulnerabilities in Notepad++ code itself.”
The exact mechanism through which this was realized is currently being investigated, Ho added.
The development comes a little over a month after Notepad++ released version 8.8.9 to address an issue that resulted in traffic from WinGUp, the Notepad++ updater, being “occasionally” redirected to malicious domains, resulting in the download of poisoned executables.
