Notepad++ backdoored for months by China-linked attackers

Chinese-linked hackers operated a backdoor in popular source and text code editor Notepad++ for more than six months sideloading persistent malware, according to security researchers.

Open source Windows-based code editor Notepad++ said independent researchers had pointed the finger at China for the attack, which targeted the update process for specific users from June until December 2, 2025.

In a blog post dated February 2, Notepad++ developer Don Ho said: “The compromise occurred at the hosting provider level rather than through vulnerabilities in Notepad++ code itself. Traffic from certain targeted users was selectively redirected.”

A CISA spokesperson told Reuters, the agency "is aware of the reported compromise and is investigating possible exposure across the United States Government (USG)."

Redirecting update traffic

The backdoor issue affected traffic to the Notepad++ updater WinGUp. Targeted users attempting to update the popular code and text editor were redirected to malicious servers that prompted them to download an illegitimate Notepad++ update binary.

Research by cybersecurity firm Rapid7 found the download included an NSIS installer which sideloaded a malicious DLL and encrypted shellcode for the installation of the backdoor, dubbed "Chrysalis."

The attackers had access to the hosting server used for Notepad++ updates from June 2025 until December 2, 2025. Rapid7 attributes the attack with "moderate confidence" to Lotus Blossom.

Ivan Feigl, author of the Rapid7 blog, said the "sophisticated and permanent tool" used legitimate binaries to sideload the DLL, custom API hashing, layered obfuscation, and structured C2 communication.

Attacks and remediation

Once fully activated, Chrysalis established an internet connection with a user agent and C2 api.skycloudcenter.com to transfer data.

Notepad++ had first raised the issue in December after it received reports of traffic hijacking, it patched WinGUp’s security practices to verify the certificate and signature of the downloaded installer and has migrated to a new hosting provider “with significantly stronger security practices.”

The Notepad++ team initially said on Monday they had not been able to identify clear IoCs for the attack, "While signs of an intrusion were identified, no concrete indicators of compromise (...) We also requested IoCs directly from the former hosting provider, but we were not able to obtain any."

Rapid7's more in depth investigation shared file indicators, network indicators and MITRE TTPs, however the researchers concurred that "no definitive artifacts were identified to confirm exploitation."

Notepad++ IoCs

File indicators

Network indicators

MITRE TTPs

*IOCs contributed by @AIexGP on X.