A nasty surprise for all coders and word processors: Notepad++'s update servers were in the hands of attackers for over six months. Those who were unlucky ended up with a state-sponsored Trojan from China instead of a bug fix between June and December 2025.
Developer Don Ho has the bomb burstFrom June until December 2, 2025, the editor's infrastructure was down.proThe attackers exploited a vulnerability at the then-current shared hosting provider. According to Ho, this wasn't a widespread attack, but rather a case of "highly selective targeting." The hackers carefully considered who they would send the manipulated "update.exe" to and who they would allow access to the legitimate servers.
According to the security expert Kevin Beaumont Organizations focused on East Asia were particularly affected. Those targeted had their updaters redirected to the attackers' servers. In the worst-case scenario, this resulted in full remote access to the keyboard, allowing hackers to intercept sensitive data as it was being typed.
What users need to do now
Don Ho has finally taken decisive action, changed hosting providers, and hardened the entire update process. Anyone using Notepad++ should act immediately and check that at least version 8.8.9 is installed, as this version now enforces strict signature verification and tightened certificate controls.
Additionally, it is recommended to manually check the local temp folder for files like "update.exe" or "Autoupdate.exe" and delete them if they are present without an active update process. A one-time manual download of the latest version directly from the official website or via GitHub ensures that you are no longer using a manipulated route from the old host.
A political aftermath
It's no secret that Don Ho already gave the Chinese government the middle finger back in 2019 with special editions like the "Free Uyghur" version. The fact that a likely state-backed group from China is now striking back leaves a very bad taste in the mouth. It remains to be seen whether other open-source projects with a similar political stance will now also come under increased scrutiny.
