Notepad++ Updater Hijack: What Happened and the Fix

Short answer: The project says the problem is fixed in current versions. Get Notepad++ only from notepad-plus-plus.org or the project's GitHub releases and keep it current. In 2025, attackers took over the project's former shared hosting server. They redirected update traffic from selected users to malicious installers. The Notepad++ code itself was not hacked. The updater, WinGUp, now checks the installer's signature (since v8.8.9) and the signed update file (since v8.9.2). If you are on an older version, download the current installer by hand. The current version is 8.9.9.

Official-source review — 8 November 2026 UTC: We checked the Notepad++ announcements for v8.8.7, v8.8.8, v8.8.9, v8.9, v8.9.2 and v8.9.9, the incident post of 2 February 2026 and the clarification of 5 February 2026, the official v8.9.9 download page, and the write-ups by Rapid7 and Kaspersky. We did not analyse any malicious file, and we did not test the updater. Everything we say about the attack comes from those sources. On 8 November 2026 at 11:52 UTC we downloaded npp.8.9.9.Installer.x64.exe (7,028,968 bytes) and npp.8.9.9.checksums.sha256 from the project's official GitHub release, and did not run the installer. Its SHA-256 was a18cfb33d616c8eecda0059604d40bdb9d607fbc4ede857c8be6e41986464367, matching the line for that file in the published checksum file. Windows reported a valid Authenticode signature from NOTEPAD++ (Paris, FR), with a certificate issued by GlobalSign GCC R45 CodeSigning CA 2020. We did not verify the GPG signature of the checksum file.

What happened to the Notepad++ updater?

Notepad++ has a built-in updater called WinGUp. It asks the Notepad++ website where the newest installer is, then downloads and runs it.

On 2 February 2026 the project published "Notepad++ Hijacked by State-Sponsored Hackers". According to that post:

The attack was a compromise of infrastructure at the hosting provider. It was not caused by a flaw in the Notepad++ code.
Attackers could intercept and redirect update traffic meant for notepad-plus-plus.org.
Only traffic from certain targeted users was redirected, to update files controlled by the attackers.
Several independent researchers assessed the attacker as likely a Chinese state-sponsored group.

The weak point was in the updater. The v8.8.9 announcement says the updater did not check the integrity and authenticity of the downloaded file strongly enough. Someone who could intercept the traffic could make it download and run a different program.

When did the Notepad++ update hijack happen?

The project's post gives this timeline, mostly quoting a statement from its former hosting provider:

Date	Event	Source
June 2025	The incident began.	Notepad++
2 September 2025	The shared server was compromised until this date, when a kernel and firmware update ended the attackers' access to it.	Former hosting provider, quoted by Notepad++
10 November 2025	The security expert's analysis says the attack stopped on this date.	Notepad++
18 November 2025	v8.8.8 released. The project said it had found "a potential hijacking issue" in WinGUp.	Notepad++ v8.8.8
1 December 2025	The update script moved off the compromised server.	Former hosting provider
2 December 2025	Attackers kept stolen credentials for the provider's internal services until this date. The provider says they could have used them to redirect some update requests.	Former hosting provider
9 December 2025	v8.8.9 released with signature and certificate checks in the updater.	Notepad++ v8.8.9
2 February 2026	Full disclosure of the incident.	Notepad++
16 February 2026	v8.9.2 released with the "double lock" update checks.	Notepad++ v8.9.2

The maintainer estimates the compromise ran from June to 2 December 2025. The website has since moved to a new host.

Who was targeted, and was I affected?

Most people were not. In its clarification of 5 February 2026, the project says the attack was highly selective and aimed at specific high-value organizations. It says researchers confirmed that the vast majority of users were never affected. For most users, updating to the latest version is enough.

Kaspersky's report of 3 February 2026 describes three infection chains between July and October 2025, aimed at about a dozen machines. The victims it lists were individuals in Vietnam, El Salvador and Australia, a government organization in the Philippines, a financial organization in El Salvador, and an IT service provider in Vietnam.

Rapid7's write-up of 2 February 2026 links the campaign, with moderate confidence, to a group it tracks as Lotus Blossom. In its case, the Notepad++ updater process GUP.exe was followed by a file called update.exe. That file installed a backdoor Rapid7 named Chrysalis.

Both reports name folders used in their cases, such as %AppData%\ProShow and %AppData%\Bluetooth. These are leads for IT teams, not a home check. If you run Notepad++ in a company, give your security team the indicator lists from Rapid7, Kaspersky and the former hosting provider. Rapid7 suggests searching logs from June to November 2025.

Which Notepad++ version fixed the updater?

The fix came in steps. Each one is described in an official release post.

Version	Released	What changed for update security
8.8.7	20 Oct 2025	Releases signed with a certificate issued by GlobalSign, instead of the project's own self-signed certificate.
8.8.8	18 Nov 2025	Addressed "a potential hijacking issue" in WinGUp. Users were asked to update by hand with the official installer.
8.8.9	9 Dec 2025	Notepad++ and WinGUp verify the signature and certificate of the downloaded installer. If the check fails, the update stops.
8.9	27 Dec 2025	Self-signed certificate no longer used. Failed checks are logged to `%LOCALAPPDATA%\Notepad++\log\securityError.log`.
8.9.2	16 Feb 2026	The update file returned by notepad-plus-plus.org is signed (XMLDSig) and verified too. WinGUp no longer needs `libcurl.dll`, and two unsafe SSL options were removed.
8.9.9	6 Nov 2026	Current release. Fixes six other vulnerabilities, not related to the 2025 hijack.

The v8.9.2 post calls the result a "double lock". The updater checks the signed XML from notepad-plus-plus.org, and then the signed installer downloaded from github.com. The project's view is that the update process is now "effectively unexploitable". We have not tested that claim.

The practical point: an old copy of Notepad++ still has the old updater. Do not rely on it to fetch the fix. Download the new installer yourself and install it over the old version.

Where is the official Notepad++ download?

There are two official places:

notepad-plus-plus.org/downloads, the project's website.
github.com/notepad-plus-plus/notepad-plus-plus/releases, where the files are actually stored. The download buttons on the v8.9.9 page all point there.

For 64-bit Windows, the file is npp.8.9.9.Installer.x64.exe. There are also 32-bit and ARM64 installers, an x64 MSI, and ZIP and 7z packages. If you use winget, the package ID is Notepad++.Notepad++. Our Notepad++ catalogue page lists the official links and file names.

Watch out for lookalikes. In April 2024 the project asked users to report notepad.plus, a copycat site that ranked well in search and was full of misleading ads. In May 2026 it warned that notepad-plus-plus-mac.org was not an official Mac version. Notepad++ has never released one. That owner later removed the Notepad++ name. Our guide to fake download sites covers the common tricks, and our download site checker tells you whether a link belongs to a known publisher. The same pattern hit 7-Zip in 2026: see why 7zip.com is not the official 7-Zip site.

On GitHub, use the files under Assets, not the "Source code" ZIP. See GitHub ZIP files with no .exe.

How do I check the Notepad++ installer's signature?

Since v8.8.7, Notepad++ binaries are signed with a certificate issued by GlobalSign, according to the v8.8.7 post. Since v8.9, the old self-signed certificate is no longer used. The project recommends removing that old root certificate if you installed it.

Before you run the installer, open PowerShell in your Downloads folder and run:

Get-AuthenticodeSignature .\npp.8.9.9.Installer.x64.exe | Format-List Status, SignerCertificate

Status should read Valid, and the certificate should be issued by GlobalSign to the Notepad++ project. On the 8.9.9 x64 installer we checked, the signer was NOTEPAD++ and the issuer was GlobalSign GCC R45 CodeSigning CA 2020. You can also right-click the file, choose Properties, and open the Digital Signatures tab. Our guide on how to check a Windows installer's digital signature walks through both methods.

Treat these as red flags: "NotSigned", "HashMismatch", a signer that is not the Notepad++ project, or any installer that claims to be Notepad++ for macOS.

How do I check the Notepad++ SHA-256 hash?

Each release on GitHub includes a checksum file, npp.8.9.9.checksums.sha256, which lists the SHA-256 of every package. The official download page links it, along with a GPG signature for the checksum file and each package, and the Notepad++ GPG public key.

Hash your download: Get-FileHash .\npp.8.9.9.Installer.x64.exe -Algorithm SHA256
Open npp.8.9.9.checksums.sha256 from the GitHub release and find the line for the same file name.
Every character must match. If it does not, delete the file and download it again from the official page.

For the 8.9.9 x64 installer, the published and measured SHA-256 is a18cfb33d616c8eecda0059604d40bdb9d607fbc4ede857c8be6e41986464367 (we checked only that file; read the other values from the project's own checksum file). You can also drop the file into our SHA-256 checker, which hashes it in your browser. If you use GPG, you can verify the checksum file itself with gpg --verify npp.8.9.9.checksums.sha256.sig npp.8.9.9.checksums.sha256 after importing the public key. Our study of Windows installer checksums shows how many publishers give you a hash to compare at all.

Should I turn off the Notepad++ auto-updater?

You do not have to. The project says the updater has been fixed. But it does give you the choice. You can untick the auto-updater during a normal install. IT teams can deploy the MSI without it:

msiexec /i npp.8.9.9.Installer.x64.msi NOUPDATER=1

The v8.9.2 post gives this command for 8.9.2. We changed only the file name. Without the updater, you must check for new versions yourself.

What this page does not do

We did not analyse the malicious updates, and we cannot tell whether your PC was targeted. We are not saying the official Notepad++ release contained malware. The sources describe redirected updates, not a changed official release. We are not rating the new update design either. If you think a work PC was hit, contact your IT or security team.

Questions

Was Notepad++ hacked?

The Notepad++ code was not. The project says its former shared hosting server was compromised, and that this let attackers redirect update traffic for selected users.

Is Notepad++ safe to use now?

The project says the issue is fully resolved in current versions. Install 8.9.9 from notepad-plus-plus.org or GitHub, and check the signature and hash first.

Which version fixed the Notepad++ updater?

v8.8.9 added installer signature and certificate checks. v8.9.2 added verification of the signed update file. Any version from 8.9.2 on has both.

When did the attack happen?

The project estimates June to 2 December 2025. Kaspersky saw malicious updates delivered between July and October 2025.

Who was behind it?

The project says researchers assessed a likely Chinese state-sponsored group. Rapid7 attributes it, with moderate confidence, to a group it calls Lotus Blossom.

I updated Notepad++ in 2025. Am I infected?

Most likely not. The project says the targeting was highly selective. Companies should check the published indicators. Home users should install the current version by hand.

Is the Notepad++ installer signed?

Yes. Since v8.8.7 the project signs its binaries with a certificate issued by GlobalSign.

Where do I find the official SHA-256 for Notepad++?

In the npp.<version>.checksums.sha256 file attached to each GitHub release. The download page links it.

Is there an official Notepad++ for Mac?

No. The project says it has never released a macOS version.

Is Notepad++ Safe After the Updater Hijack? What Happened and What Fixed It