Notepad++ Hijacked by State-Sponsored Hackers

[exxos]

Just saw this... As I use it.. others here might also..

https://notepad-plus-plus.org/news/hija ... fo-update/

According to the former hosting provider, the shared hosting server was compromised until September 2, 2025. Even after losing server access, attackers maintained credentials to internal services until December 2, 2025, which allowed them to continue redirecting Notepad++ update traffic to malicious servers. The attackers specifically targeted Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++. All remediation and security hardening were completed by the provider by December 2, 2025, successfully blocking further attacker activity.

[alexh]

Yes I saw it yesterday. I had updated during the period the update server had been hijacked (Nov 2025) but I didn't experience any Malware.

[rubber_jonnie]

I saw this too and I'm a long time user of Notepad++, though these days I'm on Mac which isn't supported, but I do use it at work and on my workbench Windows machine.

Work however is tightly controlled so we don't just get updates.

I'mm be a little circumspect when I go to update my own machines though.

[peters]

Thanks. I use it at work too. I've passed the info around my team.

[mrbombermillzy]

Luckily Ive moved from M$ over to Linux, so use the unaffected (and less politically charged it seems!) equivalent notepadqq:

https://notepadqq.com/s/