Notepad++ Supply Chain Attack Linked to Chinese State-Sponsored Hackers In December 2025, Notepad++ disclosed further details about a supply chain attack targeting its users, revealing that a China-linked threat actor likely compromised its hosting provider to distribute malicious updates. The incident, first reported by security researcher Kevin Beaumont, involved hackers exploiting the software’s updater to gain access to systems within telecom and financial firms in East Asia. An investigation led by Notepad++ creator Don Ho, alongside external security experts and the hosting provider, determined that the attack stemmed from an infrastructure-level breach. Rather than exploiting vulnerabilities in Notepad++’s code, the attackers intercepted and redirected update traffic by compromising the hosting provider’s systems. Select users were rerouted to attacker-controlled servers, which delivered malware-laced update manifests. The attack began in June 2025, with the hosting provider’s server remaining compromised until September 2, when maintenance and firmware updates were applied. However, stolen credentials allowed the threat actor to retain access to internal services until December 2, enabling continued traffic redirection. The hosting provider confirmed that only Notepad++ customers were targeted, with no evidence of broader compromise. Multiple security researchers attributed the campaign to a Chinese state-sponsored group, citing the highly selective targeting. Notepad++ has since migrated to a new hosting provider and implemented client-side measures to verify update integrity. The incident follows other recent supply chain attacks, including those affecting eScan Antivirus and EmEditor.