Supply Chain Attack Exploits Notepad++ Update Mechanism to Push Targeted Malware

Cybersecurity: Notepad++ Supply Chain Attack

Notepad++, a popular text editor among developers, was the target of a supply chain attack that compromised its update infrastructure for nearly six months.

On Tue, Feb 2, 2026, the developers disclosed that attackers gained control of the update mechanism due to a hosting provider-level incident from Jun to Sep 2025.

Despite remediation efforts, threat actors maintained access to internal services until Dec 2025, allowing continued malicious activity. Between Jul and Oct 2025, attackers frequently rotated command-and-control server addresses, downloaders, and final payloads, demonstrating advanced operational security.

Kaspersky researchers analyzing telemetry data discovered various execution chains deployed throughout the attack campaign. Three distinct infection chains were identified, targeting machines in Vietnam, El Salvador, and Australia, as well as organizations, including a government entity in the Philippines, a financial institution in El Salvador, and an IT service provider in Vietnam.

Chain #1: Late July and Early August 2025

The first malicious Notepad++ update appeared in late Jul 2025, hosted at hxxp://45.76.155[.]202/update/update[.]exe. The downloaded file functioned as an NSIS installer, sending heartbeat signals containing system information to attackers.

This was achieved by creating a directory at %appdata%\ProShow, executing shell commands to collect system data, and uploading results via curl commands.

After transmitting system information, the installer dropped multiple files, including ProShow.exe, a legitimate application subsequently abused to launch malicious payloads. Attackers exploited an old ProShow software vulnerability from the early 2010s, containing shellcodes that decrypted a Metasploit downloader payload. This downloader retrieved a Cobalt Strike Beacon shellcode designed to communicate with the CDNCheck C2 server.

Following a six-week pause, attackers resumed operations in mid-Sep 2025 with a modified infection chain. While still distributed from the same URL, the new NSIS installer was significantly smaller at 140 KB. The revised approach expanded system information collection to include whoami, tasklist, systeminfo, and netstat data.

The next-stage payload was redesigned, dropping files related to the Lua interpreter to the %APPDATA%\Adobe\Scripts directory. Attackers launched a compiled Lua script that placed shellcode into executable memory, triggering it through the EnumWindowStationsW API function. This shellcode functioned as a Metasploit downloader, retrieving Cobalt Strike Beacon from the cdncheck.it[.]com domain.

In Oct 2025, another complete overhaul occurred, with the malicious update hosted at hxxp://45.32.144[.]255/update/update[.]exe. This variant dropped files to the %appdata%\Bluetooth\ directory and used DLL sideloading to launch encrypted shellcode, an execution pattern commonly associated with Chinese-speaking threat actors.

The final payload was identified as the Chrysalis backdoor, a custom implant designed for espionage operations. The attackers' monthly rotation of infrastructure and techniques made detection challenging. Kaspersky recommends organizations hunt for NSIS installer deployments, monitor for temp[.]sh DNS resolutions, check for suspicious shell command sequences, and review network traffic for known indicators of compromise.

All three infection chains were successfully blocked by Kaspersky security solutions as the attacks occurred.

Based on reporting by GBHackers.