Notepad++ Supply Chain Attack Attributed to China-Linked

Trusted Software Weaponized

Notepad++ — one of the most widely used text editors with over 50 million downloads — has released an emergency v8.9.2 update with a "double lock" security fix. A China-linked APT group hijacked the update mechanism from June through December 2025, deploying backdoors to targeted organizations worldwide.

Attack Overview

How the Supply Chain Was Compromised

The attackers did not compromise Notepad++ source code or its GitHub repository. Instead, they intercepted the update delivery pipeline:

1. Hosting Provider Compromise
   └─ Attackers gained access to hosting provider serving updates
 
2. Update Interception
   └─ Modified update packages in transit for targeted IP ranges
 
3. Selective Targeting
   └─ Only delivered malicious updates to matching target profiles
 
4. Chrysalis Deployment
   └─ Backdoor installed silently alongside legitimate update
 
5. C2 Rotation
   └─ Servers, downloaders, and payloads constantly rotated

The selective targeting made the attack extremely difficult to detect — the vast majority of users received legitimate updates.

Attribution: Disputed but China-Linked

Chrysalis Backdoor Capabilities

• Encrypted C2 communications using custom protocol over HTTPS
• File exfiltration with automated staging and compression
• Credential harvesting from browsers and password managers
• Keylogging with application-aware context capture
• Screenshot capture triggered by specific application windows
• Lateral movement tools for internal network reconnaissance

Targeted Sectors

The "Double Lock" Fix

Notepad++ v8.9.2 implements two new security mechanisms:

1. Code-signed update verification — All update packages cryptographically signed with a new dedicated signing key
2. Pinned certificate validation — Update client pins the expected TLS certificate of the update server, preventing MitM even if a hosting provider is compromised

Defensive Recommendations

1. Update to Notepad++ v8.9.2 immediately
2. Scan for Chrysalis indicators — Check endpoints that received updates between June-December 2025
3. Review network logs — Look for connections to known Chrysalis C2 infrastructure
4. Audit all third-party update mechanisms in your environment

Sources

• Kaspersky Securelist — Chrysalis: Supply Chain Attack via Notepad++ Update Mechanism
• Dark Reading — Chinese Hackers Hijack Notepad++ Updates for Six Months
• The Hacker News — Notepad++ Official Update Mechanism Hijacked
• Help Net Security — Notepad++ Supply Chain Attack IOCs and Targets

Related Reading

• Lotus Blossom APT Compromises Notepad++ Updates to Deploy
• OpenClaw AI Agent Flaws Enable Prompt Injection, 1-Click
• Lazarus Group Plants 192 Malicious Packages in npm and PyPI