The Notepad++ project has disclosed that attackers compromised infrastructure at its former shared-hosting provider and selectively redirected software-update traffic to malicious servers. The project's account says the incident affected the hosting layer rather than exploiting a vulnerability in the Notepad++ editor itself.
According to the published investigation, the campaign began in June 2025. The shared server remained compromised until September 2, while stolen credentials continued to provide access to internal services until December 2. Those credentials allegedly allowed the attackers to keep redirecting requests for the Notepad++ domain after direct server access had ended.
The exact end date is not fully settled. Security experts working with the project assessed that malicious activity stopped on November 10, whereas the former provider's statement allowed for continued access until December 2. Notepad++ maintainer Don Ho therefore described the overall exposure window as June through December 2, the point when the provider said all attacker access was definitively blocked.
Only certain users were targeted. Their requests were routed to attacker-controlled update manifests designed to take advantage of insufficient verification in older versions of WinGup, the application's updater. Multiple independent researchers assessed that the operator was likely a Chinese state-sponsored group, according to the project's disclosure. The supplied evidence does not identify those researchers or establish attribution independently, so that conclusion remains an assessment rather than a confirmed identity.
The project moved its website to a new hosting provider and strengthened the update path. Version 8.8.9 added checks for both the downloaded installer's certificate and digital signature. Responses from the update server are now signed with XML Digital Signature, and the project said enforcement of certificate and signature verification would begin with version 8.9.2, then expected about a month later.
Ho recommended that users manually download and install version 8.9.1, which includes the relevant security improvement. That manual step was intended to move installations away from older verification behavior without relying on the potentially affected update flow.
At the time of the February 2 update, the project's incident-response team had reviewed roughly 400 gigabytes of server logs but had not produced concrete indicators such as file hashes, domains or IP addresses. Ho later linked external investigations from Rapid7 and Kaspersky that he said contained more technical detail and indicators, but those reports were not supplied as evidence for this article.
The incident demonstrates why update security must remain effective even when web infrastructure is breached. Separating code integrity from server trust through mandatory signature checks reduces the chance that control of a host or credential can turn an ordinary update request into a delivery channel for malicious software.
