The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Yes, attackers compromised infrastructure used to deliver Notepad++ updates—but that does not mean they hacked the editor’s source code or infected every user. From approximately June 2025 through December 2, 2025, attackers could selectively redirect some update requests to malicious servers. Researchers linked the espionage campaign to the China-associated Lotus Blossom group, but that attribution is an assessment, not an officially proven finding. If you used Notepad++’s built-in updater during that period, especially on a sensitive work computer, install a current release from the official project and consider whether the device needs a security investigation.
What was compromised?
The incident targeted the update-delivery path: the infrastructure and trust relationship that let an installed copy of Notepad++ check for updates. In simplified form, the affected path was:
Notepad++ on a PC → built-in updater → update infrastructure → selected redirect → attacker-controlled server → malicious payload
Attackers who could influence that path could selectively send chosen users somewhere other than the legitimate update service. A targeted user might see what appeared to be an ordinary update process while receiving attacker-controlled software or components instead.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
This is different from compromising the Notepad++ source-code repository or replacing every installer. Available project-community guidance says the known attack path involved redirected updater traffic, while manually downloaded official release binaries were not the compromised path. That is an attributed account of the known incident, not a universal guarantee about every download or every system.
Palo Alto Networks’ Unit 42 analysis describes the update-infrastructure compromise and multiple infection chains. The key point for users is that the editor’s trusted updater was abused; the evidence does not show that every Notepad++ copy became malicious.
Why reports say “six months”
“Six months” is a useful shorthand for the period from the reported initial compromise to completed remediation, but it can obscure several distinct milestones. The hosting provider reportedly cut off the attackers’ direct server access in September, while further access paths or retained credentials remained a concern until December.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- June 2025: The infrastructure compromise reportedly began.
- September 2, 2025: The hosting provider reportedly removed the attackers’ direct access to the server.
- December 2, 2025: Remediation and hardening were reportedly completed, including dealing with retained credentials or other access paths.
- December 9, 2025: Notepad++ publicly discussed reports of update-traffic hijacking and released version 8.8.9 with security improvements.
- February 2, 2026: The maintainer published a fuller disclosure after researchers analyzed the activity.
The dates come from reporting on the incident and the project’s disclosures; see the Notepad++ clarification and TechCrunch’s timeline reporting. The span does not mean attackers continuously infected every updater or pushed malware to all users throughout the period. Evidence points to selective redirection and targeted delivery.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Who was behind it?
Notepad++ maintainer Don Ho said multiple independent researchers assessed that the activity was likely conducted by a Chinese state-sponsored group. Security company Rapid7 attributed the campaign to Lotus Blossom, a China-associated espionage group, and analyzed a custom backdoor it named Chrysalis.
That is a researcher attribution, not proof that a government publicly acknowledged or was judicially shown to have directed the operation. Threat-intelligence vendors also use overlapping names for groups; aliases such as Billbug, Raspberry Typhoon, and Thrip should be treated as vendor-specific naming rather than a universally standardized identity. Tenable’s incident FAQ summarizes the attribution caveats.
What malware did the attackers deliver?
There was not just one payload. Researchers documented multiple chains, which is one reason a single filename or antivirus indicator cannot settle whether a machine was exposed.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Chrysalis: Rapid7 described this custom backdoor as part of Lotus Blossom’s toolkit. Its analysis details encrypted shellcode, evasion, execution, command-and-control behavior, and persistence. See Rapid7’s technical analysis.
- Cobalt Strike Beacon: Unit 42 observed an infection chain that ultimately delivered a Beacon. Cobalt Strike is a legitimate commercial penetration-testing platform that attackers also abuse; its presence alone does not identify a Notepad++-specific malware family.
- Lua-based loaders: Unit 42 documented a variant using Lua-script injection and Lua-based components. This illustrates why defenders should not look for only one fixed payload.
- DLL side-loading: Researchers observed malicious code loaded through the execution of a legitimate or apparently legitimate program. Kaspersky reported another chain involving legitimate ProShow software, Metasploit payloads, and Cobalt Strike.
See Unit 42’s campaign analysis and Kaspersky’s report on additional chains. Chrysalis is an important name in the story, but it should not be treated as a synonym for every payload used.
Who was targeted?
Public reporting describes a narrow espionage operation rather than a mass infection campaign. Kaspersky reported observed targeting involving a government organization in the Philippines, a financial institution in El Salvador, an IT service provider in Vietnam, and individuals in several countries. Those examples suggest attackers selected high-value victims; they do not establish the complete victim list or prove that only those countries and sectors were targeted.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
The updater was attractive because it offered a trusted execution route onto developer and enterprise computers, where users may have valuable credentials, source code, customer information, or access to production systems. A plausible update prompt also gives malicious activity cover that a random download would not have.
Was Notepad++ itself vulnerable?
The most precise description is that the incident exploited weaknesses in update delivery and verification, rather than a conventional flaw in the editor’s source code. The issue was later tracked as CVE-2025-15556, described by the National Vulnerability Database as a download-of-code-without-integrity-check vulnerability. NVD lists versions earlier than 8.8.9 as affected and assigns it a CVSS 3.1 score of 7.5, High.
“Affected” here does not mean every older installation was infected. It means those versions lacked strengthened integrity verification relevant to the attack. Risk depended on the update path, timing, targeting, and whether a malicious payload was actually delivered and executed.
HTTPS is important, but it is not a substitute for application-level verification if attackers can influence server responses, redirects, credentials, or infrastructure. The security improvements were intended to strengthen the updater’s checks of what it received.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Could your PC have been affected?
Use the update method and timing to decide whether to investigate—not simply the version number currently installed.
- Lower apparent exposure: You did not use Notepad++’s built-in updater during June 2025 through December 2, 2025, or installed from a manually downloaded official release. This lowers concern about this specific route, but cannot prove that the PC is clean from other threats.
- Potential exposure: You ran the built-in updater during the period. Exposure was selective, so this does not mean you were infected; it means the route warrants attention, particularly if the machine was a high-value target.
- Higher priority: The device belonged to a government, financial, technology, telecom, infrastructure, or politically sensitive organization; showed unusual updater activity; or generated alerts for unexpected processes, files, or outbound connections.
- Incident-response priority: The updater executed suspicious code on a system holding credentials, private keys, source code, customer data, or production access; published indicators are present; or other systems show related activity or lateral movement.
Do not conclude that a machine is clean merely because it has a recent Notepad++ version: updating the application does not establish what happened months earlier. Nor does a missing public indicator prove safety, because researchers documented multiple chains and Kaspersky cautioned that public indicators may not cover every infection.
What users should do now
- Check your installed version. Open Notepad++ and use the
?orHelpmenu, then choose its product information or About option. Wording can vary by release. - Install the current release from the official project. For remediation, do not rely solely on an old in-app updater. Use the official Notepad++ download page or the project’s GitHub releases. Check the project for the release currently available rather than assuming a historical security-fix version is still the latest.
- Assess whether the old updater ran during the exposure period. If not, and you have no other warning signs, the incident alone does not require treating the PC as compromised. If it did run, consider the sensitivity of the device and any unusual activity.
- On sensitive machines, investigate rather than merely reinstalling Notepad++. An attacker’s backdoor may persist independently of the editor. Run endpoint-security checks and review available process, file, and network history for the relevant period.
- If compromise is credible, protect accounts and secrets. Follow your organization’s response process; change credentials or revoke tokens that may have been exposed. For high-value systems, preserve evidence and consider forensic escalation or reimaging rather than assuming an application reinstall removes all persistence.
Notepad++ community guidance historically recommended manually installing version 8.9.1 for an improved updater. Version 8.9.2 added verification of the authenticity and integrity of server-returned XML using XMLDSig. These are meaningful remediation milestones, not a claim that either is the newest release now. See the project’s 8.9.1 release and 8.9.2 release notes.
For administrators and defenders
Preserve relevant endpoint and network logs before overwriting or uninstalling software. Hunt across the full June–December 2, 2025 exposure window, not only the date the story became public. Review process trees involving update.exe or gup.exe, unexpected child processes, Lua scripts or interpreters, suspicious DLL loading, Cobalt Strike artifacts, and unusual outbound connections. Compare findings against the published indicators and technical guidance from Rapid7’s mitigation and response guidance and Kaspersky’s reporting.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Indicators of compromise are useful for threat hunting, but they are not a complete incident-response plan. A clean antivirus scan or the absence of known hashes is useful evidence, not conclusive proof of no compromise. Escalate when the updater executed suspicious content on a high-value machine, when credentials or production access may be involved, or when telemetry suggests lateral movement.
What the incident says about software updates
“Official update” is not automatically equivalent to “safe update.” Software depends on a chain of trust: a project’s build and release process, hosting and routing, credentials, update metadata, and checks performed by the client. If an attacker can interfere with one link and the client does not strongly verify what it receives, a trusted application can become a delivery channel.
The practical lesson is not to avoid software updates. It is to protect update infrastructure and require strong client-side integrity checks, while users and administrators treat unexpected update behavior seriously. For Notepad++ users, the original infrastructure incident was reported remediated by December 2, 2025; that does not resolve whether a particular endpoint was previously compromised.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
