Notepad++ Updater Hijack: State Actor Served Bad Updates

What to do

1. Update every Notepad++ install to v8.9.1 or later from notepad-plus-plus.org.
2. In managed fleets, deploy the MSI without the updater: msiexec /i npp.8.9.1.Installer.x64.msi NOUPDATER=1, and update through your own software distribution.
3. Check endpoint telemetry for the Rapid7 and Kaspersky IoCs covering July-December 2025.
4. Hunt for GUP.exe launching an unexpected update.exe or NSIS installer, and for %APPDATA%\ProShow directories.
5. Remove the old Notepad++ root certificate if you installed it before v8.8.7, as the vendor recommends.

How to check if you are affected or compromised

• Query EDR for child processes of GUP.exe between June and December 2025, especially update.exe downloaded from raw IP addresses.
• Search for %APPDATA%\ProShow, ProShow.exe running from AppData, and curl uploads to temp.sh launched by unusual parents.
• Match file hashes, C2 IPs and domains against the Kaspersky Securelist and Rapid7 Chrysalis IoC lists.
• Look for whoami and tasklist output written to 1.txt by an installer process.

What happened#

On February 2, 2026, the Notepad++ maintainer disclosed that attackers had compromised the project's former shared hosting provider. They used that access to redirect update traffic from selected users to malicious update manifests. The editor's code was not changed. The weak link was the WinGUp auto-updater, which before v8.8.9 did not cryptographically verify the update metadata or the installer it downloaded. That flaw is tracked as CVE-2025-15556 (CVSS 4.0 score 7.7, assigned by VulnCheck). CISA added it to the KEV catalog on February 12, 2026.

The hosting provider's statement says the server was compromised until September 2, 2025. The attackers then kept credentials for internal services until December 2, 2025, which let them keep redirecting requests to the update endpoint. The maintainer puts the full window at June through December 2, 2025. Rapid7 attributes the campaign to the Chinese APT group Lotus Blossom, which delivered a previously undocumented backdoor it calls Chrysalis. Kaspersky documented three different infection chains between July and October 2025, ending in payloads such as Cobalt Strike Beacon.

Who is affected#

Technically, every Notepad++ install before 8.8.9 that used the built-in updater was exposed: anyone able to intercept or redirect its traffic could make it run an attacker's installer with the user's privileges. In practice, targeting was highly selective. Kaspersky saw about a dozen targeted machines: individuals in Vietnam, El Salvador and Australia, a government organization in the Philippines, a financial organization in El Salvador and an IT service provider in Vietnam. Rapid7 describes Lotus Blossom's usual targets as government, telecom, aviation, critical infrastructure and media organizations in Southeast Asia and Central America.

Do you really need to act?#

Everyone should update. That part is cheap. Whether you need to investigate depends on who you are. The vendor's clarification says "the vast majority of Notepad++ users were never affected" and that simply updating is enough for most people. Enterprises are a different case. Notepad++ is a common developer and admin tool, and the attackers chose victims for their strategic value. If you are in a targeted sector or region, or have staff who are, check your 2025 endpoint telemetry. This is also a general lesson: any updater that fetches code over the network without signature checks is a remote code path for whoever controls the network or the server.

What to do now#

1. Update to v8.9.1 or later, downloaded directly from notepad-plus-plus.org. v8.8.9 made WinGUp verify the installer's certificate and signature and abort if the check fails. Later versions also sign the update XML (XMLDSig), and the maintainer said that check would become mandatory in v8.9.2.
2. In managed environments, install without the updater and push updates yourself: msiexec /i npp.8.9.1.Installer.x64.msi NOUPDATER=1.
3. Load the Rapid7 and Kaspersky IoCs into your EDR or SIEM and search back through June-December 2025.
4. If you installed the old self-signed Notepad++ root certificate, remove it. Binaries have been signed with a GlobalSign certificate since v8.8.7.

How to tell if you were hit#

The common thread in the research is GUP.exe (the updater) launching an unexpected update.exe, an NSIS installer downloaded from a raw IP address. Rapid7 saw one from 95.179.213.0, and Kaspersky saw one from 45.76.155[.]202. In one chain Kaspersky observed, the installer ran cmd /c whoami&&tasklist > 1.txt, uploaded the output to temp[.]sh with curl.exe, and dropped a legitimate but vulnerable ProShow.exe into %APPDATA%\ProShow to launch shellcode. Search for those artifacts and match hashes, IPs and domains against the published IoC lists. The maintainer's own incident response team reported finding no concrete IoCs in about 400 GB of hosting logs, so rely on endpoint data. On any confirmed hit, isolate and rebuild the machine and rotate the credentials it held.

Timeline#

• Jun 2025 — Compromise begins, by the maintainer's estimate.
• Sep 2, 2025 — The hosting provider says server access ended. The attackers keep service credentials.
• Dec 2, 2025 — The provider rotates credentials and attacker activity stops.
• Dec 9, 2025 — Notepad++ v8.8.9 adds installer certificate and signature verification.
• Feb 2, 2026 — The maintainer discloses the hijack and Rapid7 publishes its Chrysalis research. The CVE is published February 3, and Kaspersky's analysis follows.
• Feb 12, 2026 — CISA adds CVE-2025-15556 to KEV, due March 5.

Vulnerability records

• CVE-2025-15556 · KEV 2026-02-12 · Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Notepad++ — Notepad++ Hijacked by State-Sponsored Hackers (Feb 2, 2026) notepad-plus-plus.org
2. Notepad++ — Important Clarification: Notepad++ Security Incident (Feb 5, 2026) notepad-plus-plus.org
3. Notepad++ — v8.8.9 release: Vulnerability-fix (Dec 9, 2025) notepad-plus-plus.org
4. NVD — CVE-2025-15556 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities Catalog: CVE-2025-15556 cisa.gov
6. VulnCheck — Notepad++ WinGUp updater lacks update integrity verification vulncheck.com
7. Rapid7 — The Chrysalis Backdoor: A Deep Dive into Lotus Blossom's toolkit rapid7.com
8. Kaspersky Securelist — Notepad++ supply chain attack securelist.com