Notepad++ fixed updater bugs that allowed malicious update hijacking

Notepad++ addressed an updater vulnerability that allowed attackers to hijack update traffic by exploiting weak authentication of update files in earlier versions. The issue came to light after security researcher Kevin Beaumont reported incidents affecting Notepad++ users, including organisations in East Asia, with targeted activity that appeared to originate from China and involved initial access via Notepad++ processes.

In mid-November, Notepad++ released a fix to harden its GUP/WinGUP updater: the updater downloads were redirected through a Notepad++ URL to a gup.xml file, which otherwise could be modified if traffic was intercepted, potentially delivering a malicious binary.

The researchers noted that although downloads are signed, older versions used a self-signed root certificate publicly available on GitHub, weakening validation, and that traffic to notepad-plus-plus[.]org is infrequent enough to make ISP-level redirection feasible for well-resourced actors. Notepad++ confirmed that WinGUp updater was sometimes redirected to malicious servers, and the company’s update forced downloads to come only from GitHub with 8.8.8, making interception far harder.