The open-source text Notepad++, a staple for developers and power users since 2003, became an unwitting vector for a targeted cyberattack last year. The breach—confirmed in an official update—was not a flaw in the software itself but a far more insidious compromise: malicious actors hijacked the ’s update infrastructure, redirecting users to malicious servers for months between June and early December 2025.
The attack exploited vulnerabilities at the hosting provider level, allowing attackers to intercept and reroute traffic destined for notepad-plus-plus.org. While the exact technical methods remain under investigation, security researchers have identified a sophisticated backdoor, codenamed Chrysalis, as the tool behind the operation. Unlike conventional malware, Chrysalis employs layered obfuscation, custom API hashing, and undocumented system calls to evade detection—a hallmark of advanced persistent threat (APT) groups.
- Attack timeline: June–December 2025 (hosting provider and researchers dispute precise dates).
- Target: Notepad++ update traffic, not the ’s codebase.
- Attacker: Suspected Chinese state-sponsored group Lotus Blossom, known for Southeast Asia/Central America espionage.
- Tool: Chrysalis backdoor, featuring multi-stage shellcode loading and stealth persistence.
- Impact: Users redirected to malicious servers; hosting provider switched to a more secure alternative.
Cybersecurity firm Rapid7’s analysis suggests Lotus Blossom is refining its tradecraft. The group’s use of legitimate binaries for DLL sideloading—a technique that embeds malicious code within trusted processes—combined with custom communication protocols, signals a shift toward resilience against modern detection systems. This evolution raises broader concerns: if a widely trusted tool like Notepad++ can be weaponized through hosting-level compromises, what other open-source projects or small-scale developers might be at risk?
The breach also underscores a critical weakness in shared hosting environments. Unlike enterprise-grade security, smaller projects often rely on third-party providers that may lack robust defenses against state-level actors. Notepad++’s developer has since migrated to a hosting solution with significantly stronger security practices, but the incident serves as a warning: supply-chain attacks are no longer confined to supply chains. They now target the digital plumbing that keeps software alive.
For developers and IT teams, the takeaway is clear. Even the most trusted tools can become unwitting participants in cyber espionage. The question now is whether hosting providers—and the open-source ecosystem—can keep pace with threats that blend into the infrastructure itself.
