Last year, the creator of Notepad++ released an update for the text and source code editor after security experts reported that bad actors hijacked its update mechanism to redirect traffic to malicious servers. This leads users to download compromised executables that can infect their devices. Today, Don Ho revealed that several security experts are investigating the breach and have determined that the threat actor is “most likely a Chinese state-sponsored group.” He said this explains why experts observed very selective targeting during the campaign and why traffic from some users was redirected to download malicious files. It is not clear what kind of users are specifically targeted and what the files are doing on their devices.

The attackers began redirecting traffic from Notepad ++ to their servers sometime in June 2025, and that continued until December 2. Their method included compromising the system at the level of the hosting provider, although the exact technical mechanism that allowed them to intercept the traffic remains under investigation. In addition to the release of a security patch, Notepad++ also migrated to a new hosting provider with stronger security practices. Ho now encourages anyone who wants to install the app to download version 8.9.1which includes security updates, and manually running the installer.