Notepad Plus Plus Gets Hacked: Chinese Spies Weaponize Your Favorite Text Editor in Wild Supply Chain Heist

This is your Digital Dragon Watch: Weekly China Cyber Alert podcast. Hey listeners, Ting here with your Digital Dragon Watch: Weekly China Cyber Alert, diving straight into the hottest chaos from the past seven days ending February 2, 2026. Buckle up, because Chinese state-sponsored hackers just pulled off a sneaky supply chain ninja move on Notepad++, that trusty open-source text editor devs everywhere swear by. Picture this: back in June 2025, bad guys—likely the Zirconium crew, aka Violet Typhoon—cracked into Notepad++'s shared hosting server on notepad-plus-plus.org. They didn't blast everyone; nah, they got surgical, redirecting update traffic from select victims straight to their malicious servers. Security researcher Kevin Beaumont spotted the smoke first in early December, linking it to hands-on-keyboard intrusions at three East Asia-focused orgs in telecom and finance. Don Ho, Notepad++'s dev wizard, confirmed it all in his February 2 blog post: attackers held server access till September 2, then clung to internal creds till December 2, serving tainted updates via a buggy verification flaw. TechCrunch and The Register both nailed the details—highly targeted espionage, echoing SolarWinds but with Beijing flair. Targeted sectors? Dev tools sneaking into IT and software teams worldwide, but zeroed in on East Asia interests. New vector: infrastructure-level hosting hijacks, exploiting shared servers to intercept rare update pings without touching the code itself. Help Net Security called it a masterclass in traffic redirection. US gov's firing back hard. FCC dropped a January 29 alert urging telecoms to patch fast, enforce MFA, and segment networks amid ransomware spikes—echoing Salt Typhoon's 2024 telecom breaches by Chinese spies. FDD's February 2 tracker slams the Trump admin's National Defense Strategy for ghosting China's cyber prepositioning in US critical infra, while renominating Sean Plankey to lead CISA. Congress is gunning for pig-butchering scams too—H.R.5490's Dismantle Foreign Scam Syndicates Act eyes China's complicity in scam compounds like Myanmar's Shwe Kokko, per Tech Policy Press, blending cybercrime with espionage. Expert recs? Kevin Beaumont says check your gup.exe logs for shady network calls beyond notepad-plus-plus.org or GitHub. Don Ho patched the updater and migrated hosts—grab v8.7 or later, folks. Talion's Donnan Mallon warns of state actors' infra compromises; layer up with endpoint detection, verify update hashes, and ditch shared hosting for sensitive projects. Anthropic notes Chinese hackers automating attacks via AI agents—stay vigilant on agentic threats. Whew, Dragon's roaring, but we're arming up. Thanks for tuning in, listeners—subscribe for weekly drops to keep your nets dragon-proof. This has been a Quiet Please production, for more check out quietplease.ai. For more http://www.quietplease.ai Get the best deals https://amzn.to/3ODvOta This content was created in partnership and with the help of Artificial Intelligence AI.