State-sponsored attackers, likely linked to Chinese groups as reported by multiple independent researchers, hijacked Notepad++’s update mechanism to redirect traffic to malicious servers. The attack, which compromised the hosting provider’s infrastructure rather than Notepad++ code, began in June 2025 and targeted specific users, particularly in telecommunications and financial services in East Asia. The attackers exploited a flaw in the update verification process, allowing them to serve tampered update manifests. Despite losing server access temporarily in September 2025, they maintained control until December by using stolen internal service credentials. The incident was attributed to the Violet Typhoon group (aka APT31) and later linked to the Chinese APT group Lotus Blossom by Rapid 7 researchers, who identified a sophisticated backdoor named Chrysalis. This campaign exposes aspects of security exposure faced by software supply chains, especially those involving open-source projects. The attack followed a pattern similar to previous incidents like ASUS’s ShadowHammer campaign, with selective targeting rather than broad exploitation. Notepad++ has since migrated to a new hosting provider, strengthened its update mechanism, and implemented cryptographic signing for updates in version 8.8.9. CTIX Analysts advise users to change credentials, update systems, and enable automatic updates. The Notepad++ team plans further security enhancements, including mandatory certificate signature verification in version 8.9.2, expected soon.