Notepad++ hack: Supply chain threats evolve

The developers behind Notepad++ acknowledged on Monday that an attack on a shared hosting server in June 2025 led to a damaging compromise of the popular source-code editor’s update process — and the installation on targeted systems of a custom-developed backdoor application dubbed “Chrysalis.” 

Notepad++ said the attack began with a hack of a shared hosting server in June 2025 by malicious actors affiliated with China. The compromise enabled the attackers to intercept and redirect Notepad++ update requests from targeted users and organizations to malicious servers controlled by the attackers, resulting in the download of the Chrysalis malware. 

The attack, which first came to light in December, highlights the growing risks facing software engineering teams as malicious actors look to exploit the diverse and vulnerable infrastructure used to maintain and manage deployed applications. 

Here’s what you need to know about the Notepad++ compromise — and how it marks an evolution of software supply chain attacks.

Download: Software Supply Chain Security Report 2026Join discussion: Report webinar

How the Notepad++ compromise happened

Security researcher Kevin Beaumont said the malicious actors “specifically targeted the Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++,” including the use of a self-signed root certificate to sign updates.

Ars Technica reported that Beaumont first got interested in the Notepad++ application after noticing details in bug fixes for Notepad++ Version 8.8.8 in November. Those included changes to “harden the Notepad++ Updater from being hijacked to deliver something … not Notepad++.”

Specifically, an updater application known as WinGUP, or just GUP, was altered. GUP is used to report the version in use to the notepad-plus-plus(dot)org domain and then retrieve a URL for the Notepad++ update from a file named gup.xml. That file is then downloaded to the %TEMP% directory of the requesting device and executed.

The Chrysalis malware used in the Notepad++ attacks had never been detected before. A report by Rapid7 researchers describes Chrysalis as “a custom, feature-rich backdoor” with “a wide array of capabilities.” 

The malware was intended to give attackers persistent access to compromised systems, with features designed to avoid detection, Rapid7 wrote. That includes the use of legitimate binaries to sideload a crafted DLL with a generic name to frustrate filename-based detection, custom API hashing in the loader and the main module, and more. “Overall, the sample looks like something that has been actively developed over time,” the Rapid7 researchers wrote. 

Beaumont reported that organizations that downloaded Chrysalis experienced security incidents including “hands-on keyboard” attacks, giving malicious actors remote access to the compromised systems.

In response to the attack, Notepad++ migrated its website to a more secure hosting provider and updated the WinGUP updater so that it verifies both the certificate and signature of the downloaded installer. Finally, the XML returned by the Notepad++ update server is now signed using XMLDSig. Both the certificate and signature verification will be enforced in an upcoming Notebook++ update, the company said.  

How software supply chain threats are evolving

The Notepad++ attack resembles previous supply chain attacks including the SunBurst-Orion hack and 3CX’s Desktop App attack in its choice of a popular and widely used piece of software, but the similarities end there, said Tomislav Pericin, chief software architect at ReversingLabs.

This is not a SunBurst-type supply chain attack. It's not trying to hide itself in the app code. They’ve swapped the update file with something that isn’t really Notepad++, and that launches the app itself.

Tomislav Pericin

But the compromise highlights the growing diversity of software supply chain threats and attacks, as malicious actors expand their scope: look to exploit both vulnerable open-source and third-party code dependencies, developers, and supporting infrastructure to gain access to sensitive codebases, development pipelines, and software distribution ecosystems.  

Why you must go beyond implicit trust 

As noted in ReversingLabs’ Software Supply Chain Security Report 2026, attackers are increasingly targeting open-source ecosystems, CI/CD workflows, and high-impact domains in industries such as cryptocurrency and AI. Investments in platform security and maintainer protections are shifting attackers’ focus to targets such as Notepad++, which was characterized by weaker controls and trusted infrastructure that is vulnerable to compromise. 

One of the key takeaways from the latest RL report is that defending your software supply chain is going to require a shift in mindset away from implicit trust and toward continuous validation. In 2026, both software producers and end-user organizations must recognize that the trust model is broken and gain the ability to inspect open-source and proprietary software.

While the risks highlighted in RL’s report are real and growing, so is the industry’s collective ability to address them. The Software Supply Chain Security Report 2026 serves as both a warning and a guide to AppSec teams — and is a must-read for CISOs looking to better manage software supply chain risk in 2026.