Notepad++ hacked by cybercriminals likely affiliated with China

Notepad++, a very popular open-source text editor among IT professionals, announced on February 2, 2026, that it had been the victim of a hack carried out by cybercriminals likely affiliated with China. The attackers did not compromise the software itself, but hijacked one of its update mechanisms in order to “intercept and redirect network traffic.”

The attack began in June 2025 and continued until December 2025. The cybercriminals targeted only a small number of Notepad++ users, thereby limiting the risk of being identified. The project’s administrators did not specify the criteria used by the attackers to select their victims.

Notepad++ has since moved its update infrastructure to a new provider. Independent security researchers, whose identities have not been disclosed, attributed the attack to a state-sponsored actor backed by China.