#1
#1 out of 136.0K est. views
technology21h ago
Notepad++ updates got hijacked for months and could have spied for China
- Hackers hijacked Notepad++ updates for six months, redirecting targeted users to malicious manifests.
- The breach occurred from June through December 2025, according to developer Don Ho.
- Hackers likely belonged to a Chinese state-sponsored group and could have given remote access to keyboards.
- Notepad++ developers terminated all attacker access by December 2, 2025.
- Users are advised to update to version 8.8.9 or newer from the official site.
- Independent expert Kevin Beaumont suggested monitoring for gup.exe and suspicious update.exe in TEMP.
- The attackers targeted organizations with East Asia interests, per Don Ho’s post.
- The updater has been updated with stronger security measures to verify updates.
- The incident underscores risks of third‑party hosting in software supply chains.
- Users should download updates directly from the official Notepad++ site.
Vote 3