cyber.hendryadrian.com
Security News · bleepingcomputer.com

Notepad++ 8.9.2 Adds Dual Verification to Secure Updates

· Original article ↗

Summary

Notepad++ 8.9.2 verifies GitHub-signed installers and XMLDSig-signed update metadata, hardening updates after a six-month compromise attributed to Lotus Blossom that used the Chrysalis backdoor.

Key points

  • Notepad++ 8.9.2 combines GitHub-signed installer verification with checks for XMLDSig-signed update metadata from notepad-plus-plus[.]org.
  • The auto-updater removes libcurl.dll to reduce DLL side-loading risk, removes two unsecured cURL SSL options, and restricts plugin-management execution to programs signed with WinGUp’s certificate.
  • The article says attackers compromised the updater’s hosting provider starting in June 2025 and selectively redirected some users’ update requests to malicious servers; the campaign was attributed to Lotus Blossom.
  • Rapid7’s analysis identified the custom Chrysalis backdoor in the attack chain.
  • The project changed hosting providers, rotated credentials, and fixed flaws exploited in the attacks.
  • Users are urged to upgrade to version 8.9.2 and download installers only from notepad-plus-plus[.]org; MSI deployments can disable the updater with NOUPDATER=1.

Article Details

Event Type
Notepad++ introduced a double-lock update verification mechanism in version 8.9.2 following a supply-chain compromise.
Impact
From June 2025 until its discovery on December 2, 2025, attackers selectively redirected some Notepad++ update requests from a compromised hosting provider to malicious servers and used the Chrysalis backdoor. Notepad++ added GitHub installer and signed XML verification, hardened its auto-updater, changed hosting providers, rotated credentials, and patched the exploited flaws.

MITRE ATT&CK

T1195.002 · Compromise Software Supply ChainThe attackers compromised the hosting provider used by the Notepad++ updater and redirected selected update requests to malicious servers, affecting the software supply chain.

Threat Actors

Lotus BlossomThe six-month Notepad++ supply-chain compromise is attributed to Lotus Blossom; the article describes the group as linked to China.

Malware

ChrysalisThe change follows a six-month compromise attributed to the Lotus Blossom group that used the Chrysalis backdoor, and users are urged to upgrade to 8.9.2 and download installers only from the official domain.

Products

Notepad++Notepad++ has rolled out a “double-lock” update verification in version 8.9.2 that checks both the GitHub-signed installer and an XMLDSig-signed XML from notepad-plus-plus.org to prevent supply-chain tampering.WinGUPThe auto-updater was hardened by removing libcurl.dll, eliminating unsafe cURL SSL options, and restricting plugin management execution to programs signed with WinGUp’s certificate.

Countries

ChinaEarlier this month, Notepad++  and Rapid7 researchers disclosed that the update infrastructure was compromised in a six-month-long campaign attributed to Lotus Blossom, a threat group linked to China.

Industries

SoftwareThe attacks exploited weak update verification controls used in older versions of the software, and continued until their discovery on December 2, 2025.

Related Articles