Hijacked Notepad++ updater quietly targeted users for months

There are plenty of indie, third-party alternatives to standard Windows apps, many of them much-loved by power users. Take Notepad++, a text editor that’s a potent upgrade to Windows’ basic Notepad, and in active development for over 20 years. Just make sure you take the most recent version, because a previous update was hijacked by hackers.

Don Ho, the creator and maintainer of the popular program since 2003, announced the hack on the official Notepad++ site, a little less than two months after vulnerabilities in its WinGUp update system were discovered. Researchers found that occasionally the updates were delivering “compromised executables,” which were infected between June and December of 2025. Though the Notepad++ program itself was never unsafe, the update mechanism was used to deliver additional software, presumably spyware or malware.

Various independent researchers pointed the finger at “a Chinese state-sponsored group,” which was highly selective in choosing its targeted users. Ho says that the Notepad++ website and the update provider have been upgraded with more stringent security, and that the latest version, 8.9.1, has new security enhancements. He recomends downloading and installing it manually.

“With these changes and reinforcements, I believe the situation has been fully resolved. Fingers crossed,” said Ho.