Supply Chain: Notepad++ Hijacked

Introduction

Let’s be honest: we all love Notepad++. It’s that one lightweight, reliable tool that’s been on every developer’s machine since the dawn of time. It doesn't nag you for subscriptions, it doesn't track your every move (usually), and it just works. Or at least, it did until it became the latest poster child for why supply chain security is currently a burning dumpster fire.

Between late 2025 and early 2026, while most of us were busy arguing about the next big AI framework, a state-sponsored threat actor cluster known as FatBeehive (or Silk Typhoon) was busy turning Notepad++ into a delivery vehicle for malware.

At packet.guru, we’ve dug through the post-mortem. Here’s how your favorite text editor was weaponized.

The "Budget" Infiltration

You’d think a software project with millions of downloads would have its update infrastructure locked down tighter than Fort Knox. Well, think again. The attackers didn't need zero-days or complex exploits to get in. They targeted the "plumbing" specifically, the shared hosting provider for notepad-plus-plus.org.

Yes, you read that right. One of the most popular development tools in the world was using shared hosting for its update manifests. It’s like keeping the keys to a Ferrari under a plastic rock in the front yard.

The Timeline of Stealth

The breach started in June 2025. In September, the hosting provider ran some kernel updates that wiped the attackers' shell access.

You’d think that was the end of it, right? Wrong. The FatBeehive group had already exfiltrated internal service credentials. They didn't need a shell anymore, they had the keys to the kingdom. They continued to redirect traffic for three more months without anyone noticing.

Anatomy of the Attack

The technical culprit here is WinGUp — the Windows General Updater used by Notepad++. Before version 8.8.9, WinGUp was a bit too trusting. It was like a courier who delivers a package without checking if the sender's ID is real.

The Selective Redirection

The attackers were smart. They didn't infect everyone. If they had, telemetry would have lit up like a Christmas tree in days. Instead, they used a "precision strike" method.

When you clicked "Check for Update," your machine sent a request to the server. The attackers, sitting on that compromised host, would check your IP.

Are you a random hobbyist? Here's the real update.
Are you a tele communications firm, a bank, or a government agency? Congratulations, you’ve been selected.

The server would send back a malicious XML manifest, pointing the updater to a rogue binary instead of the legitimate one.

Comparing the Flows

Feature	Legitimate Update Flow	High-Value Target Flow (Hijacked)
Trigger	User clicks "Update"	User clicks "Update"
Server Response	Standard `update.xml`	Malicious XML with rogue URL
Payload Verification	None (Pre-v8.8.9)	None (Blindly accepts binary)
Execution	Installs Notepad++	Drops `AutoUpdater.exe` (Malware)
Outcome	Updated Editor	System Compromised + Network Map Exfiltrated

Meet "AutoUpdater.exe"

Once the hijacked updater ran, it dropped a file called AutoUpdater.exe into the %Temp% folder. And no, it didn't encrypt your files and ask for Bitcoin. That would be too loud.

This was an espionage play. The malware used Living-off-the-Land (LotL) tactics, which is a fancy way of saying it used Windows own tools against it. It ran commands like tasklist, netstat -ano, and systeminfo to map out the internal network.

System Alert

The Punchline: It used curl.exe to exfiltrate the stolen data to temp.sh, a public file-sharing site. Because, hey, what security system is going to block a standard Windows utility talking to a common web service?

The Geopolitics of Code

It’s worth noting that Notepad++ developer Don Ho has never been shy about his political stances (Free Taiwan, Human Rights, etc.). In the world of APTs (Advanced Persistent Threats), if you have a big platform and an opinion that offends a nation-state, you’ve effectively invited them to try and break your stuff. While the motive was likely strategic espionage, the choice of target feels personal.

Frequently Asked Questions (FAQ)

Here is what you need to know to stay safe.

Q: Is my version of Notepad++ safe?

Only if you are on version 8.8.9 or higher. This version finally implements mandatory digital signature and certificate validation. If you are on an older version, your "Update" button is basically a game of Russian Roulette.

Q: How do I check if I was compromised?

Monitor your %Temp% folders. If you see GUP.exe spawning curl.exe processes that talk to random file-sharing sites (like temp.sh), you have a problem.

Q: What should I do now?

Update immediately to the latest version.
Audit your logs for suspicious curl activity.
Question everything. Even the tools you use to write your code can be turned against you.

Conclusion

In the end, the Notepad++ hijack wasn't a failure of code, but a failure of infrastructure trust. We’ve spent decades securing our repositories while leaving the "last mile" of delivery wide open.