Notepad++ Hacked by China: 6 Months of Silent Espionage

Let me break this down: imagine going to the grocery store, buying a sealed water bottle from your favorite brand, only to find out someone poisoned it before it even reached the shelf. Not at your home, not at the store, but directly at the factory. That's exactly what happened to Notepad++, the text editor used by more than 28 million people worldwide.

On February 2, 2026, Don Ho, Notepad++'s creator, publicly confirmed what security researcher Kevin Beaumont had discovered two months earlier: hackers linked to the Chinese government had compromised Notepad++'s download server for six months. From June through December 2025, everyone who downloaded the program unknowingly received a version infected with espionage malware.

But here's the twist: they didn't attack everyone. The malware was selective. It only activated if it detected you were at a telecommunications company or financial institution in East Asia. The rest of the users carried poison in their water, but it never affected them. At least, not directly.

In this article, I'll break down what a supply chain attack is (and why it's so dangerous), how the Notepad++ attack worked exactly, who's behind it, who the victims were, and most importantly, what you can do right now to protect yourself.

What is a supply chain attack and why should you care

The poisoned water analogy

Think of it like this: you want to attack a specific person. You have two options: go to their house and try to break in (risky and difficult), or poison the city's water supply knowing that person will drink from it.

A supply chain attack is exactly that, but in the digital world. Instead of attacking your target directly, you compromise something your target trusts and uses regularly: a software update, a code library, a download server.

The trick is that the user has no reason to suspect anything. You didn't download the program from a shady site. You didn't click on a weird link. You went to the official website, downloaded the official version, and trusted it was safe. That trust is exactly what these attacks exploit.

Why they're so hard to detect

What most guides won't tell you is that traditional antivirus software is designed to detect known threats. They look for malware signatures, suspicious patterns, anomalous behaviors. But when the malware comes digitally signed by the original developer (because the attacker compromised the signing process), your antivirus sees a legitimate program.

It's like a food inspector checking the water bottle and saying "seal intact, authentic brand, everything checks out." The poison is inside, but the packaging is perfect.

The SolarWinds precedent

If this type of attack sounds familiar, that's because we saw it in 2020 with SolarWinds. Russian hackers compromised the Orion software, used by 18,000 organizations including the U.S. Treasury Department and Microsoft. The attack went undetected for months.

The difference with Notepad++ is the level of selectivity. SolarWinds was a massive attack affecting thousands of organizations. The Notepad++ attack was surgical: millions of people infected, but the malware only activated for specific targets. It's the difference between a bomb and a sniper rifle.

How the Notepad++ attack worked: anatomy of an espionage operation

Step 1: Compromising the hosting server (not the code)

Here's the clever part: they didn't touch Notepad++'s source code. Don Ho, the developer, maintains the code on GitHub and reviews it constantly. A malicious change would have been detected by the developer community.

Instead, the attackers compromised the hosting server where the download files are stored. Think of it like this: the program's code is like a medicine recipe. The recipe is protected in a vault. But the attackers didn't go after the recipe; they went to the factory where the pills are produced and contaminated them there.

Notepad++'s download server is on a third-party service. The attackers found a vulnerability (not yet publicly disclosed) and exploited it to modify the executable files without altering the original source code.

Step 2: Injecting the Chrysalis malware

Once inside the server, the attackers replaced the legitimate Notepad++ installer with a modified version that included a backdoor called Chrysalis. This name isn't random: in biology, a chrysalis is the transformation phase from caterpillar to butterfly. The malware remains dormant until conditions are right.

Chrysalis is a loader that works like this:

1. It installs alongside Notepad++ completely invisibly
2. It stays dormant on most systems
3. It periodically checks if the system meets certain criteria (which we'll see later)
4. If the criteria are met, it downloads and executes the next phase of the attack

What most guides won't tell you is that Chrysalis has a minimal footprint (less than 100KB) and doesn't do anything suspicious until it receives orders. A superficial system analysis wouldn't detect anything abnormal.

Step 3: Deploying Cobalt Strike only on select targets

This is where the attack becomes truly sophisticated. Chrysalis didn't deploy its final payload on just any computer. Before activating, it verified:

• IP range: Does the computer belong to a corporate network of a telecommunications or financial company in East Asia?
• Active Directory domain: Is it connected to a specific enterprise infrastructure?
• Installed software: Does it have tools that would indicate it's a development or administration machine?

Only if all conditions were met, Chrysalis downloaded Cobalt Strike, a legitimate pentesting tool that attackers commonly use to move laterally within corporate networks, exfiltrate data, and establish long-term persistence.

Let me break this down with an analogy: imagine a burglar entering an apartment building. They have a master key that opens all doors, but they only enter apartments where they detect large safes. They ignore the other apartments, even though they could technically enter.

The attack timeline

Who's behind it: APT31 and China's Ministry of State Security

APT31's profile (Violet Typhoon)

Security researchers attribute this attack to APT31, also known as Violet Typhoon, Zirconium, Judgment Panda, and Bronze Vinewood. Yes, hacker groups have more aliases than a soap opera character.

APT stands for Advanced Persistent Threat. The number 31 is simply the identifier assigned by the cybersecurity industry. The "Violet Typhoon" name is part of Microsoft's nomenclature, which uses natural elements and colors to classify threat actors.

Who are they really? According to multiple Western intelligence agencies (including the FBI, MI5, and Germany's BfV), APT31 operates under the direction of China's Ministry of State Security (MSS). They're not independent hackers or criminals looking for money. They're intelligence operatives with state resources.

APT31's attack history

This isn't their first rodeo. APT31 has an extensive track record:

What most guides won't tell you is that APT31 has two modes of operation. One is traditional espionage: stealing secrets from governments and companies. The other, more concerning, is what's called prepositioning: installing backdoors in critical infrastructure that could be activated in case of conflict. It's like planting digital landmines.

Why they attacked Notepad++

It might seem strange that a state espionage group would attack a simple text editor. But Notepad++ isn't "simple." It's:

• The most popular text editor in the world after those built into operating systems
• Extensively used by developers and system administrators
• Free and open source, which generates trust
• Especially popular in Asia, where it has a huge user base

If you want to spy on telecommunications and financial companies, what better vector than a program their system administrators use daily? It's the perfect Trojan horse.

Who were the victims: a surgical strike

The target profile

The Chrysalis malware was programmed to activate only on systems meeting very specific criteria:

1. Sector: Telecommunications and financial services
2. Geography: East Asia (primarily mainland China, Hong Kong, Taiwan, South Korea, and Japan)
3. System type: Servers and administration workstations

Why these sectors? Telecommunications control a country's communications. If you have access to a phone carrier's internal systems, you can intercept calls, messages, and data from millions of people. Financial entities, meanwhile, handle sensitive economic information that can be used for industrial espionage or even market manipulation.

The geopolitical focus is obvious. China has strategic interests in all these countries, whether due to territorial disputes (Taiwan), economic competition (South Korea, Japan), or internal surveillance (Hong Kong).

The actual number of victims

This is where the story gets complicated. Notepad++ has over 28 million downloads in recent years alone. During the six months the server was compromised, potentially millions of people downloaded infected versions.

But—and this is an important "but"—the malware only activated on specific targets. That means most users have Chrysalis dormant on their systems, but it never activated.

Is this good or bad? It depends on how you look at it:

• Good: If you weren't a target, the malware never did anything on your system
• Bad: You have malicious code installed that could be reactivated or reprogrammed

Don Ho hasn't revealed the exact number of victims where the attack completed, probably because the investigation is ongoing and there are legal implications. What we do know is that several Asian telecommunications companies reported intrusions now being linked to this attack.

How to protect yourself: a practical step-by-step guide

If you use Notepad++

Step 1: Check your current version

1. Open Notepad++
2. Go to ? (Help) > About Notepad++
3. Check the version number

If you have any version before v8.9.1: You must update immediately.

Step 2: Update to the safe version

1. Go to https://notepad-plus-plus.org/downloads/
2. Download version v8.9.1 or higher
3. Completely uninstall the previous version
4. Install the new version

Important: Don't use Notepad++'s built-in updater for this specific update. Download the new installer directly.

Step 3: Run a security scan

Even if you weren't a direct target, it's good practice to run a full system scan. If you want to go beyond basic antivirus, check out our guide on best cybersecurity tools 2026 where we analyze EDR solutions that detect these types of threats.

If you manage enterprise systems

Things get more serious if you're responsible for an organization's security:

1. Software inventory

Create an inventory of all systems where Notepad++ is installed. Tools like SCCM, Intune, or any asset management solution can help.

2. Search for indicators of compromise (IoCs)

Although Don Ho hasn't published specific IoCs (probably due to the ongoing investigation), you can look for:

• Unusual outbound connections from systems with Notepad++ installed
• Unrecognized DLL files in the installation directory
• Suspicious child processes launched from notepad++.exe

3. Mass update

Deploy version v8.9.1 to all systems centrally. Don't trust users to update on their own.

4. Enhanced monitoring

If your organization is in telecommunications or finance in East Asia, consider that you may have been a specific target. Intensify network and endpoint monitoring over the coming weeks.

General recommendations against supply chain attacks

This Notepad++ attack is a reminder that even legitimate software can be compromised. These are practices you should adopt:

Verify download hashes: Many software projects publish checksums (SHA256) of their files. Compare the hash of the downloaded file with the official one.

Use official sources: Although in this case the attack came from the official source, avoid downloading software from unofficial mirrors or third-party sites.

Monitor network traffic: Anomaly detection tools can identify when an apparently legitimate program starts communicating with suspicious servers.

Segment your network: If a system is compromised, segmentation prevents attackers from moving laterally to more critical systems.

Maintain offline backups: In case of serious compromise, being able to restore from a clean backup is your last line of defense.

Why this matters: the geopolitical context

The digital cold war between China and the West

The Notepad++ attack doesn't exist in a vacuum. It's part of a continuous escalation of cyber operations between major powers. In recent years we've seen:

• Volt Typhoon: Another Chinese group prepositioning malware in U.S. critical infrastructure
• Salt Typhoon: Massive campaign against U.S. telecommunications companies
• Cross-sanctions: The U.S. sanctioning Chinese cybersecurity companies; China banning American products

What most guides won't tell you is that we're in a digital arms race. Supply chain attacks are the equivalent of biological weapons: hard to detect, with a multiplier effect, and exploiting trust in apparently secure systems.

The specific problem of open source software

Notepad++ is open source software maintained primarily by one person: Don Ho. It doesn't have Microsoft's security budget or Google's response team. And yet, it's used by millions of people, including in critical infrastructure.

This attack exposes a systemic vulnerability: the world's digital infrastructure depends on projects maintained by volunteers with limited resources. The code can be publicly reviewed (which is good), but the distribution infrastructure (servers, digital signatures, CI/CD pipelines) is a single point of failure.

After Log4Shell in 2021, there was a lot of talk about better funding open source software. Three years later, we're still seeing attacks like this. The conversation hasn't translated into sufficient action.

Implications for individual users

You might think: "I'm not an Asian telecommunications company, this doesn't affect me." And technically you're right: the malware didn't activate on your system.

But consider this:

1. You weren't a target today, but you could be tomorrow: The activation criteria can change. The malicious code is there.

2. Domino effect: If your employer or clients were compromised through Notepad++, your information could be indirectly exposed.

3. Dangerous precedent: Every successful supply chain attack shows other attackers that the method works. We'll see more.

4. Erosion of trust: If you can't trust software you download from official sources, what can you trust?

This case adds to a concerning trend we've documented in other articles, such as the one about Chrome extensions stealing AI conversations or the Crunchbase data breach. Attack vectors multiply and the vulnerable surface grows every day.

FAQs: Frequently asked questions about the Notepad++ hack

Which versions of Notepad++ are affected?

All versions downloaded between June and December 2025 are potentially compromised. Don Ho hasn't specified exact version numbers because the problem wasn't in the code but in the download server. The confirmed safe version is v8.9.1, published after cleaning the infrastructure. If you have any earlier version and downloaded it during that period, you should update.

How do I know if the malware activated on my computer?

If you don't work in telecommunications or finance in East Asia, the malware most likely remains dormant on your system. However, the only way to be certain is to run an analysis with advanced EDR tools that detect the Chrysalis loader. Traditional antivirus may not detect it because the code doesn't do anything suspicious until it activates.

Why aren't there public indicators of compromise (IoCs)?

Don Ho and security researchers have chosen not to publish detailed IoCs yet. This is probably because the investigation is ongoing, there are potential legal implications, and publishing the IoCs could help attackers modify their malware to evade detection. It's common practice in serious security incidents to temporarily withhold certain technical information.

Is it safe to continue using Notepad++?

Yes, as long as you use version v8.9.1 or higher downloaded after February 2, 2026. The server has been cleaned, additional security measures have been implemented, and Don Ho is working with cybersecurity experts to prevent future incidents. Notepad++ remains an excellent text editor; this incident doesn't invalidate the quality of the software itself.

Could the same thing happen to me with other software?

Absolutely. Supply chain attacks can affect any software: from text editors to browsers, from programming libraries to operating system updates. The best defense is to maintain a proactive security posture: verify hashes when possible, use anomalous behavior detection tools, segment networks, and maintain updated backups. No one is immune.

Conclusion: the water we drink is no longer safe

The Notepad++ hack isn't just a story about a compromised text editor. It's a warning about the fragility of the digital infrastructure we all depend on.

For six months, millions of people downloaded poisoned software from an official source, trusting it was safe. The attackers didn't need to trick them with phishing emails or exploit vulnerabilities in their computers. They simply poisoned the well.

What concerns me isn't this specific attack—the direct victims were limited and the damage is being contained. What concerns me is what it represents: an increasingly sophisticated attack model where trust itself is the exploitation vector.

When you can't trust software you download from the developer's official website, security stops being a technical problem and becomes a philosophical one. What can we trust? How do we verify what's true?

For now, the actions are clear: update Notepad++ to v8.9.1, run security scans, and stay alert. But in the long term, as an industry and as a society, we need to solve a deeper problem: how to protect the digital supply chain we all depend on.

The water we drink no longer comes factory sealed. And that should concern us all.