The Notepad++ maintainers have published the findings of an investigation documenting a months-long compromise of the software's distribution infrastructure. The attack, attributed by Rapid7 to the Chinese cyber-espionage group Lotus Blossom, enabled the selective redirection of update traffic to attacker-controlled servers to distribute malware to target organizations in the telecom and financial sectors of East Asia. Persistence was maintained through credentials stolen before September 2, 2025, which preserved operational access until December 2, 2025 — three months after the hosting provider believed remediation was complete.
- The compromise occurred at the shared hosting provider level, not through a vulnerability in Notepad++ code.
- Traffic from selected users was redirected to attacker-controlled servers serving malicious update manifests.
- Credentials obtained before September 2, 2025 enabled persistent access until December 2, 2025.
- Notepad++ has migrated to a new provider and implemented client-side update integrity verification.
How the Update Hijacking Worked
The attack focused on the shared hosting infrastructure hosting notepad-plus-plus.org. According to details made public by Don Ho, the project's creator and maintainer, the attackers managed to intercept and redirect traffic destined for the software's update site. The redirection was not indiscriminate: it affected specifically "certain targeted users," indicating an active filtering mechanism by the operators.
The hosting provider identified that Notepad++ had been specifically targeted, with no evidence that other customers on the same shared server were affected. This precision suggests preliminary infrastructure reconnaissance and deliberate selection of the software as an initial access vector. The exact technical mechanism of the infrastructure compromise remains under investigation.
"Traffic from certain targeted users was selectively redirected to attacker-controlled server malicious update manifests"
— Don Ho, Notepad++ creator and maintainer
The 'Ghost Access' That Outlasted Remediation
The critical point in the timeline is the gap between perceived remediation and actual persistence. On September 2, 2025, during scheduled maintenance, the provider updated the kernel and firmware of the compromised server. This action should have cut off attacker access. Instead, credentials obtained before that date allowed continued access to the provider's internal services until December 2, 2025.
This three-month window allowed the attackers to continue redirecting traffic and distributing malware despite the infrastructure intervention. The case highlights a recurring pattern: visible technical remediation did not eliminate persistent access based on previously stolen credentials. The provider has not disclosed details about the compromised credentials or the affected internal services.
Attribution to Lotus Blossom and Chrysalis Malware
Rapid7 attributed the operation to Lotus Blossom, a China-linked cyber-espionage group with documented activity spanning over a decade. The custom malware distributed in the operation is named Chrysalis; the dossier provides no technical details on it. The attribution rests on Rapid7's technical analysis; at present no confirmed infrastructure overlaps from independent sources link the operation to other known groups.
The stated targets — telecom and financial services in East Asia — fall within the traditional scope of Chinese cyber-espionage. The lack of detail on targeting criteria makes it impossible to determine whether selection occurred in real time or was predetermined.
Recommended Actions
For organizations running Notepad++ in enterprise environments, three actions follow directly from the documented case.
First: verify that the version released after the official disclosure has been installed, which includes client-side verification of update integrity. Notepad++ implemented this mechanism in response to the incident; its absence indicates an unpatched installation.
Second: review network logs from the June–December 2025 period for connections to notepad-plus-plus.org showing routing anomalies or non-standard DNS resolution. The documented selective redirection may have left traces in corporate proxies and firewalls.
Third: assess reliance on open-source software distributed via shared hosting where the project does not directly control the infrastructure. The case demonstrates that this dependency introduces supply-chain risk independent of source-code security.
Notepad++'s Response and the Limits of Disclosure
Notepad++ has released updates to prevent updater hijacking and migrated to a new hosting provider. The implementation of client-side update integrity verification represents an architectural change that, according to the source, was not present before the incident. The exact nature of these checks is not detailed in the public disclosure.
Independent researcher Kevin Beaumont reported in early December 2025 that organizations using Notepad++ had been targeted with malicious software updates, anticipating the official disclosure by several weeks. This delay between informal detection and structured communication left enterprise users without verifiable operational guidance for a significant period.
Frequently Asked Questions
Should I uninstall Notepad++?
The brief does not report any such recommendation from Notepad++ or the source. The compromise was tied to the hosting infrastructure, not the software code, and the migration to a new provider has been completed.
How did the attackers select victims?
The dossier does not specify the targeting criteria. It is unknown whether redirection was based on geolocation, ASN, IP ranges, or other identifiers.
Has the Chrysalis malware been publicly analyzed?
The name Chrysalis is reported by the source, but the dossier contains no technical analysis of the malware nor details on its capabilities or indicators of compromise.
Information is based on the cited source and current as of publication.