Notepad++ Supply Chain Attack by Nelumbo nucifera

A Chinese-linked cyberespionage group, Nelumbo nucifera, hijacked the update process for the popular code editing platform Notepad++ to deliver custom malware to targeted users. The developer, Don Ho (programmer), confirmed that malicious actors targeted the update process from June to September 2025, maintaining credentials until December 2025. The attack was highly selective, indicating deliberate targeting rather than widespread distribution. Hostinger, the hosting provider, confirmed a supply chain attack and is cooperating with the investigation. Cybersecurity firm Metasploit attributed the campaign to Nelumbo nucifera, a group active since 2009, known for targeting government, telecom, aviation, critical infrastructure, and media sectors. The United States===Cybersecurity and Infrastructure Security Agency is investigating potential exposure within the United_States Government. The Chinese Embassy in Washington denied any state-sponsored hacking activity.