{"id":209984,"date":"2026-02-02T05:55:00","date_gmt":"2026-02-02T10:55:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/02\/02\/nation-state-hack-exploited-hosting-infrastructure-to-hijack-notepad-updates\/"},"modified":"2026-02-04T12:20:16","modified_gmt":"2026-02-04T17:20:16","slug":"nation-state-hack-exploited-hosting-infrastructure-to-hijack-notepad-updates","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/02\/02\/nation-state-hack-exploited-hosting-infrastructure-to-hijack-notepad-updates\/","title":{"rendered":"Nation-state hack exploited hosting infrastructure to hijack Notepad++ updates"},"content":{"rendered":"

Nation-state hack exploited hosting infrastructure to hijack Notepad++ updates<\/a><\/p>\n

https:\/\/securityaffairs.com\/187531\/security\/nation-state-hack-exploited-hosting-infrastructure-to-hijack-notepad-updates.html?amp<\/a><\/p>\n

Publish Date: 2026-02-02 05:55:00<\/a><\/p>\n

Source Domain: securityaffairs.com<\/a><\/p>\n

Nation-state hack exploited hosting infrastructure to hijack Notepad++ updates<\/h2>\n<\/p>\n

\t\t\t\t\t\t\t Pierluigi Paganini<\/span>
\n\t\t\t\t\t\t\t\"\"\/ February 02, 2026<\/span><\/p>\n

\t\t\t\t\t\t\"\"\/<\/p>\n

Notepad++ maintainer says nation-state attackers hijacked the app\u2019s update system by redirecting traffic at the hosting provider level.<\/h2>\n

The Notepad++ maintainer revealed that nation-state hackers compromised the hosting provider\u2019s infrastructure, redirecting update traffic to malicious servers. The attack did not exploit flaws in Notepad++ code but intercepted updates before they reached users.<\/p>\n

\u201cAccording to the analysis provided by the security experts, the attack involved infrastructure-level compromise that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org.\u201d reads the advisory<\/strong> published by the software maintainers. \u201cThe exact technical mechanism remains under investigation, though the compromise occured at the hosting provider level rather than through vulnerabilities in Notepad++ code itself. Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests.\u201d<\/p>\n

The incident began in June 2025 and was linked by multiple researchers to a likely Chinese state-sponsored group, based on its highly selective targeting. Attackers compromised a shared hosting server until September 2, 2025, and later used stolen internal credentials to redirect Notepad++ update traffic to malicious servers until December 2. <\/p>\n

The hosting provider moved all affected customers to a new server, fixed the vulnerabilities that were abused, and rotated all credentials that may have been exposed.<\/p>\n

After completing these actions, the provider reviewed system logs and confirmed there was no evidence of continued attacker access or malicious activity.<\/p>\n

The security expert found the attack ended on November 10, 2025, while the hosting provider reported possible attacker access until…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Nation-state hack exploited hosting infrastructure to hijack Notepad++ updates https:\/\/securityaffairs.com\/187531\/security\/nation-state-hack-exploited-hosting-infrastructure-to-hijack-notepad-updates.html?amp Publish Date: 2026-02-02 05:55:00 Source…<\/p>\n","protected":false},"author":1,"featured_media":209985,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/securityaffairs.com\/wp-content\/uploads\/2015\/01\/Notepad-logo.png","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[31],"class_list":["post-209984","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-exploit"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/209984"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=209984"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/209984\/revisions"}],"predecessor-version":[{"id":209986,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/209984\/revisions\/209986"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/209985"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=209984"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=209984"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=209984"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}