- Updated: February 2, 2026
- 5 min read
Notepad++ Update Hijacked by State‑Sponsored Attackers – What You Need to Know
Skip to main contentThe homepageThe VergeThe Verge logo.The VergeThe Verge logo.TechReviewsScienceEntertainmentAIPolicyHamburger Navigation ButtonThe homepageThe VergeThe Verge logo.Hamburger Navigation ButtonThe VergeThe Verge logo.Notepad++ updates got hijacked for months and could have spied for ChinaTechCloseTechPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All TechNewsCloseNewsPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All NewsSecurityCloseSecurityPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All SecurityNotepad++ updates got hijacked for months and could have spied for ChinaThe app’s servers were compromised from June through December 2025.The app’s servers were compromised from June through December 2025.by Stevie BonifieldCloseStevie BonifieldNews WriterPosts from this author will be added to your daily email digest and your homepage feed.FollowFollowSee All by Stevie BonifieldFeb 2, 2026, 8:43 PM UTCLinkShareGiftPhoto by Amelia Holowaty Krales / The VergeStevie BonifieldCloseStevie BonifieldPosts from this author will be added to your daily email digest and your homepage feed.FollowFollowSee All by Stevie Bonifield is a news writer covering all things consumer tech.Stevie started out at Laptop Mag writing news and reviews on hardware, gaming, and AI.Users of the text and code editor Notepad++ may have unknowingly downloaded a malicious update for the app after its shared hosting servers were hijacked last year.On Monday, the app’s developer, Don Ho, posted an update on the attack with more details, including that the hackers were “likely a Chinese state-sponsored group” and that the app’s servers were vulnerable for roughly six months from June through December 2nd, 2025.The post explains that the hijacking occurred on the app’s unnamed, now-former hosting provider’s end, stating that “Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests.” When victims were redirected, their app update could be replaced with a malicious executable that, according to independent cybersecurity expert Kevin Beaumont, may have given the hackers remote access to a victim’s keyboard.Don Ho’s post also adds that the attack involved “highly selective targeting” in terms of the victims it redirected away from the legitimate Notepad++ website. Kevin Beaumont noted that the victims he spoke with “are [organizations] with interests in East Asia.” So, while this is a serious security vulnerability, it’s possible that the hackers were busy watching specific people instead of just anyone.The developer did not specify when they became aware of the attack, but said that “all attacker access was definitively terminated” by December 2nd. The Notepad++ updater has been updated itself with stronger security measures to check for tampering and verify that updates are legitimate.Notepad++ users should make sure they are on at least version 8.8.9, which addressed the vulnerabilities from the hijacking attack, and they should probably download that version directly from the Notepad++ website. Additionally, Kevin Beaumont suggested users double-check that they’re not using an unofficial version of Notepad++, keep a close eye on activity from “gup.exe,” the app’s updater, and check for a suspicious “update.exe” or “AutoUpdater.exe” file in their TEMP folder.Notably, Don Ho, the developer of Notepad++, criticized the Chinese government in a 2019 app update. He called that version the “Free Uyghur” edition, and told The Verge at the time that his website had faced DDoS attacks in response.Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.Stevie BonifieldCloseStevie BonifieldNews WriterPosts from this author will be added to your daily email digest and your homepage feed.FollowFollowSee All by Stevie BonifieldNewsCloseNewsPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All NewsSecurityCloseSecurityPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All SecurityTechCloseTechPosts from this topic will be added to your daily email digest and your homepage feed.FollowFollowSee All TechMost PopularMost PopularBill Gates says accusations contained in Epstein files are ‘absolutely absurd’The tragedy of SupernaturalClaude Code is suddenly everywhere inside MicrosoftThis tiny pocket-friendly e-reader is packed with frustration and potentialBest gas masksThe Verge DailyA free daily digest of the news that matters most.Email (required)Sign UpBy submitting your email, you agree to our Terms and Privacy Notice.This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.Advertiser Content FromThis is the title for the native adMore in TechFirefox is adding a switch to turn AI features offAmazon’s desk-friendly Echo Show 8 is down to its lowest price everRaspberry Pi is raising prices again as memory shortages continueJeffrey Epstein arranged a meeting with Tim Cook for the former head of WindowsFormer Windows 8 boss recruited Epstein to help negotiate his messy Microsoft exitAbxylute’s new Switch 2 controller is for all the diehard GameCube fansFirefox is adding a switch to turn AI features offEmma RothTwo hours agoAmazon’s desk-friendly Echo Show 8 is down to its lowest price everSheena VasaniTwo hours agoRaspberry Pi is raising prices again as memory shortages continueAndrew Liszewski6:52 PM UTCJeffrey Epstein arranged a meeting with Tim Cook for the former head of WindowsRichard Lawler6:45 PM UTCFormer Windows 8 boss recruited Epstein to help negotiate his messy Microsoft exitTom Warren6:09 PM UTCAbxylute’s new Switch 2 controller is for all the diehard GameCube fansAndrew Liszewski5:23 PM UTCAdvertiser Content FromThis is the title for the native adTop Stories4 minutes agoElon Musk merges SpaceX with xAI (and X)6:09 PM UTCFormer Windows 8 boss recruited Epstein to help negotiate his messy Microsoft exit11:00 AM UTCMeet the women furious with Mark Zuckerberg for killing Supernatural8 minutes agoWill Elon Musk’s emails with Jeffrey Epstein derail his very important year?Feb 1Shedding light on Iran’s longest internet blackoutFeb 1This tiny pocket-friendly e-reader is packed with frustration and potential
Andrii Bidochko
CTO UBOS
Andrii Bidochko is an AI entrepreneur and researcher focused on AI agents, reinforcement learning, and autonomous systems. He writes about the technologies shaping the future of machine intelligence, from frontier models and agent architectures to real-world AI applications.