Notepad++ update infrastructure compromise enables targeted malicious software delivery

A compromise affecting the official hosting infrastructure used by Notepad++ allowed attackers to intercept update traffic and selectively redirect users to attacker-controlled infrastructure between June and December 2025. Unit 42 found that the attackers breached the shared hosting provider environment and served malicious update manifests to selected targets, with infection chains delivering Cobalt Strike and the Chrysalis backdoor. The compromise occurred at the hosting-provider level rather than through vulnerabilities in the Notepad++ source code, but it abused the legitimate Notepad++ update channel to reach downstream users. Unit 42 attributed the activity to LOTUS BLOSSOM.