Your Text Editor Was a Chinese Spy Tool for 6 Months (Here’s How They Did It)

While you were writing code, your text editor was writing reports back to Beijing.

Notepad++, the free, trusted workhorse used by millions, got hijacked by Chinese state hackers from June to December 2025. Not through a vulnerability in the code. Through something scarier: they compromised the hosting provider and weaponized the update mechanism itself.

Last week’s disclosure (CVE-2025–15556) revealed the full nightmare.

The Attack in 60 Seconds

What happened: Chinese APT group Lotus Blossom (aka Raspberry Typhoon/APT31) compromised Notepad++’s hosting provider and hijacked the WinGUp auto-updater.

Who got hit: Fewer than two dozen carefully selected targets, government agencies in Southeast Asia, financial institutions in Central America, IT companies in Vietnam, individuals in El Salvador.

How it worked: When victims clicked “update,” the compromised server served a malicious XML manifest pointing to update.exe on attacker infrastructure instead of the real Notepad++ installer. Everyone else got normal updates. Surgical precision.

Timeline:

• June 2025: Attack begins via compromised hosting
• Sept 2025: Hosting provider patches vulnerabilities, attackers lose direct access
• Dec 2025: Attackers finally lose stolen credentials after 6 months
• Dec 9, 2025: v8.8.9 released with hardened security
• Feb 2, 2026: Full public disclosure

The Technical Breakdown (The Scary Parts)

The malware deployed was legitimately impressive:

Chrysalis Backdoor: Custom payload with 12+ commands:

• Reverse shell access
• File upload/download
• Process execution
• Full self-removal capabilities
• Hardcoded decryption key: gQ2JR&9;

Infection Chains (3 different variants observed):

1. DLL sideloading with legitimately signed Bitdefender (bdselfpr.exe) and Trend Micro (TmDbgLog.dll) binaries
2. ProShow software exploit chain
3. Microsoft Warbird abuse, using Microsoft’s own code protection framework to hide malware

C2 Infrastructure:

• Domains: api.skycloudcenter[.]com, api.wiresguard[.]com, temp[.]sh
• Disguised traffic with Chrome user-agents
• Monthly server rotation
• Fake DeepSeek-style URLs to blend in

Execution: Everything ran in-memory to dodge antivirus. Files dropped in %APPDATA%\Bluetooth with names like BluetoothService.exe and log.dll.

Security researcher Kevin Beaumont caught it when multiple organizations reported Notepad++ processes spawning “hands on keyboard” activity, real humans actively exploring networks, not just bots.

Why This Attack Is Genius (And Terrifying)

Here’s what makes this different from typical supply chain attacks:

1. They weaponized trust The WinGUp updater didn’t verify cryptographic signatures on the XML manifest or downloaded files. If the manifest said “download from here,” it just did. No questions.

2. They were invisible Highly targeted = low detection risk. Most Notepad++ users never saw malicious updates. Only the specific victims the attackers wanted got infected.

3. They were patient Even after losing direct server access in September, they maintained credential access for three more months. Six months total inside the infrastructure. No payloads observed after November 2025, they went dark before discovery.

4. They used legitimate tools DLL sideloading with signed security software binaries. Microsoft’s own obfuscation framework. These aren’t script kiddies, this is APT31, operating since 2009.

What You Need to Do Right Now

If you use Notepad++:

Update to v8.9.1+ immediately, download manually from GitHub or the official site (ironic, I know)

Check if you were exposed: Did you update Notepad++ between June-December 2025? Work in telecom, finance, government, or IT in Southeast Asia or Central America?

Hunt for IOCs:

• Check %TEMP% for update.exe
• Look in %APPDATA% for hidden Bluetooth folders
• Scan for connections to temp[.]sh, api.skycloudcenter[.]com, api.wiresguard[.]com
• Kaspersky and Rapid7 published full IOC lists on GitHub

Remove old certificates: Uninstall any self-signed certificates from pre-v8.9 versions

The fix: New versions cryptographically verify XML responses (XMLDSig), enforce certificate checking, and the site’s been migrated to a new hosting provider.

The Real Lesson

Developer tools are the new crown jewels for state-sponsored hackers.

Why attack hardened corporate networks when you can compromise the text editor, IDE, or package manager developers trust? Get into a dev’s machine = access to source code, production credentials, AWS keys, internal systems.

Notepad++ joins VSCode extensions, npm packages, PyPI libraries, and GitHub Actions as confirmed targets. If developers use it, attackers want in.

And they’re not exploiting code vulnerabilities anymore, they’re attacking infrastructure, update mechanisms, trust relationships. The boring backend stuff nobody audits.

My Takeaway

I’m not ditching Notepad++. The software is solid, this was an infrastructure breach, now fixed. Don Ho’s maintained this for two decades as free open-source software. Respect.

But I’m changing how I think about updates.

Automatic updates used to feel safe. Now they feel like calculated risk. I’m verifying more. Downloading from GitHub when possible. Checking release signatures. Being paranoid about what runs on my machine.

Because here’s the uncomfortable truth: the attackers stayed hidden for six months. How many other tools are compromised right now that we just haven’t caught yet?

That’s the question keeping security researchers up at night.