{"id":"notepad-updater-hijack-feb-2026","category":"patch","status":"closed","title":"Notepad++ updater flaw CVE-2025-15556 used to deliver malware; fixes released","tldr":"Attackers hijacked Notepad++ updates to infect selected Windows users. Version 8.8.9 fixed installer verification; 8.9.2 added signed update-instruction checks. Install the current release manually and ask IT to investigate potentially affected work PCs.","summary":"Attackers compromised Notepad++’s former hosting infrastructure and redirected selected Windows users’ update requests to malicious downloads. The WinGUp updater’s insufficient verification, tracked as CVE-2025-15556, allowed an attacker-controlled installer to run with the user’s permissions. Notepad++ dates the compromise from June to 2 December 2025, although investigators placed the last observed attack on 10 November. The vendor says targeting focused on high-value organisations and most users were unaffected. Researchers subsequently identified malware providing persistent remote access and a broader geographical spread of victims. Version 8.8.9, released on 9 December, added installer signature and certificate checks. Version 8.9.2, released on 16 February 2026, also checks signed update instructions. The hosting incident is resolved according to Notepad++, and fixes are available. CISA confirmed exploitation on 12 February. Updating protects the update process; potentially infected computers still need investigation.","action":"Download the current Windows installer directly from the official Notepad++ website and install it manually. Version 8.8.9 fixes this CVE, while 8.9.2 adds further protection for update instructions. If a work computer used the updater between June and 2 December 2025, ask its IT team to check for compromise rather than relying on the update alone.","product":"Notepad++ for Windows and its WinGUp updater","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2025-15556"],"tags":["notepad-plus-plus","windows","updater","supply-chain","malware"],"affected":["Notepad++ versions before 8.8.9 using the WinGUp updater"],"fixed":["Notepad++ 8.8.9: downloaded-installer signature and certificate verification","Notepad++ 8.9.2: additional verification of signed update instructions"],"matches":[{"platform":"windows","app":"Notepad++","bundle":"","fixed":"8.8.9"}],"sources":[{"kind":"advisory","title":"Notepad++ v8.8.9 release: Vulnerability-fix","url":"https://notepad-plus-plus.org/news/v889-released/","by":"Notepad++","date":"2025-12-09"},{"kind":"advisory","title":"Notepad++ Hijacked by State-Sponsored Hackers","url":"https://notepad-plus-plus.org/news/hijacked-incident-info-update/","by":"Notepad++","date":"2026-02-02"},{"kind":"advisory","title":"Important Clarification: Notepad++ Security Incident","url":"https://notepad-plus-plus.org/news/clarification-security-incident/","by":"Notepad++","date":"2026-02-05"},{"kind":"advisory","title":"Notepad++ v8.9.2 release - Double-Lock Update Security","url":"https://notepad-plus-plus.org/news/v892-released/","by":"Notepad++","date":"2026-02-16"},{"kind":"news","title":"Notepad++ update feature hijacked by Chinese state hackers for months","url":"https://www.bleepingcomputer.com/news/security/notepad-plus-plus-update-feature-hijacked-by-chinese-state-hackers-for-months/","by":"BleepingComputer","date":"2026-02-02"},{"kind":"research","title":"Nation-State Actors Exploit Notepad++ Supply Chain","url":"https://unit42.paloaltonetworks.com/notepad-infrastructure-compromise/","by":"Palo Alto Networks Unit 42","date":"2026-02-11"},{"kind":"advisory","title":"CISA Adds Four Known Exploited Vulnerabilities to Catalog","url":"https://www.cisa.gov/news-events/alerts/2026/02/12/cisa-adds-four-known-exploited-vulnerabilities-catalog","by":"CISA","date":"2026-02-12"}],"started":"2026-02-12","closed":"2026-02-16","created":"2026-11-03T22:31:38.638Z","updated":"2026-11-03T22:31:38.638Z","cve_notes":[{"cve":"CVE-2025-15556","name":"Missing installer verification in Notepad++ updater","what":"Insufficient integrity and authenticity checks in Notepad++’s WinGUp updater allowed attackers who redirected update traffic to supply an installer that ran their code with the user’s permissions.","severity":"unknown","cvss":7.5}],"timeline":[{"at":"2026-02-16","added":"2026-11-03T22:23:31.291Z","kind":"new-fix","text":"Notepad++ released 8.9.2, adding verification of signed update instructions alongside the installer checks introduced in 8.8.9. The vendor said these protections fully addressed the update-hijacking weakness.","url":"https://notepad-plus-plus.org/news/v892-released/","by":"Notepad++","patch":"patched"},{"at":"2026-02-12","added":"2026-11-03T22:23:31.291Z","kind":"cisa-added","text":"CISA added CVE-2025-15556 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation.","url":"https://www.cisa.gov/news-events/alerts/2026/02/12/cisa-adds-four-known-exploited-vulnerabilities-catalog","by":"CISA","patch":null},{"at":"2026-02-11","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"Unit 42 reported previously unreported campaign infrastructure and evidence affecting organisations in South America, the US, Europe and Southeast Asia. Its findings included malware providing persistent remote access.","url":"https://unit42.paloaltonetworks.com/notepad-infrastructure-compromise/","by":"Palo Alto Networks Unit 42","patch":null},{"at":"2026-02-05","added":"2026-11-03T22:23:31.291Z","kind":"vendor-revised","text":"Notepad++ said the incident was resolved and most users had never been affected. It published further guidance and directed organisations to check investigation findings for signs of compromise.","url":"https://notepad-plus-plus.org/news/clarification-security-incident/","by":"Notepad++","patch":null},{"at":"2026-02-02","added":"2026-11-03T22:23:31.291Z","kind":"vendor-revised","text":"Notepad++ traced the incident to its former hosting provider and confirmed that selected users received malicious update instructions. It had moved its website to another provider and recommended manually installing 8.9.1.","url":"https://notepad-plus-plus.org/news/hijacked-incident-info-update/","by":"Notepad++","patch":null},{"at":"2025-12-09","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"Notepad++ disclosed malicious update redirections and released 8.8.9. Its updater checks downloaded installers’ signatures and certificates and stops installation if verification fails.","url":"https://notepad-plus-plus.org/news/v889-released/","by":"Notepad++","patch":"patched"},{"at":"2025-12-02","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"The former hosting provider completed remediation and revoked attackers’ remaining access, according to Notepad++’s later statement. The compromise began in June 2025; researchers placed the last observed attack on 10 November, while the provider reported potential access until 2 December.","url":"https://notepad-plus-plus.org/news/hijacked-incident-info-update/","by":"Notepad++","patch":null}],"url":"https://hard.fyi/live/notepad-updater-hijack-feb-2026/","json":"https://hard.fyi/api/live?id=notepad-updater-hijack-feb-2026"}