Open-source coding app Notepad++ focused in Chinese language-linked supply-chain assault

Don Ho, the developer of Notepad++, says ‘malicious actors’ had focused the replace course of for ‘sure focused customers’ starting in June 2025

A Chinese language-linked cyberespionage group with an extended historical past hijacked the replace course of for the favored code modifying platform Notepad++ to ship a customized backdoor and different malware to focused customers, this system’s developer and cybersecurity researchers mentioned on Monday, February 2.

Don Ho, the French-based developer of Notepad++, mentioned in a weblog posted to the mission’s web site on Monday that “malicious actors” had focused the replace course of for “sure focused customers” starting in June 2025. The hackers had entry to the internet hosting server used for Notepad++ updates till September 2, 2025, however maintained credentials to some internet hosting providers till December 2, 2025, in accordance with Ho.

It was not clear which Notepad++ customers had been focused, or what number of. Ho mentioned in an e mail that he didn’t have visibility into what number of malicious updates had been downloaded. “What I do know from the investigation is that the assault was extremely selective — not all customers in the course of the compromise window acquired malicious updates, indicating deliberate concentrating on quite than widespread distribution,” Ho mentioned.

A spokesperson for the Cybersecurity and Infrastructure Safety Company mentioned the company “is conscious of the reported compromise and is investigating potential publicity throughout the US Authorities (USG).”

Ho’s weblog included a message from his internet hosting supplier concluding that the server used to ship updates to clients “might have been compromised,” and that the hackers particularly focused the area related to Notepad++.

Web registration information present that the area was hosted by Lithuanian internet hosting supplier Hostinger till January 21, a reality Ho confirmed within the e mail.

Hostinger didn’t instantly reply to a request for remark.

Cybersecurity agency Rapid7 attributed the hacking marketing campaign to a Chinese language-linked cyberespionage group tracked as Lotus Blossom in a weblog put up posted on Monday. Lively since 2009, the group has traditionally focused authorities, telecom, aviation, vital infrastructure and media sectors throughout Southeast Asia and, extra just lately, Central America, in accordance with Rapid7.

A spokesperson for the Chinese language Embassy in Washington mentioned “China opposes and fights all types of hacking in accordance with the legislation. We don’t encourage, assist or connive at cyber assaults. We reject the related events’ irresponsible assertion that the Chinese language authorities sponsored hacking exercise when it had not introduced any factual proof.”

The hacking group used its entry to ship a customized backdoor that might give it interactive management of contaminated computer systems, which might then be used as a foothold to steal information and goal different computer systems, in accordance with the evaluation.

Kevin Beaumont, a cybersecurity researcher, mentioned in a December 2, 2025, weblog put up that he was conscious of three organizations “with pursuits in East Asia,” which had safety incidents doubtlessly tied to Notepad++. – Rappler.com