# Chinese Hackers Hijacked Notepad++ Updates for 6 Months — Millions Got Backdoored

**URL:** <https://onehack.st/t/chinese-hackers-hijacked-notepad-updates-for-6-months-millions-got-backdoored/317933>\
**Category:** News & Articles\
**Tags:** hacking\
**Created:** [February 4, 2026, 6:41pm UTC](https://onehack.st/t/chinese-hackers-hijacked-notepad-updates-for-6-months-millions-got-backdoored/317933 "2026-02-04T18:41:23Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Margaret](https://onehack.st/user_avatar/onehack.st/margaret/32/174872_2.png) [@Margaret](https://onehack.st/u/Margaret)\
**Post date:** [February 4, 2026, 6:41pm UTC](https://onehack.st/t/chinese-hackers-hijacked-notepad-updates-for-6-months-millions-got-backdoored/317933/1 "2026-02-04T18:41:24Z")

</div>

# Chinese Hackers Hijacked Notepad++ Updates for 6 Months — Millions Got Backdoored

> Your favorite text editor was secretly a government spy. Auto-updates delivered malware instead of patches.

![hacked](https://media.giphy.com/media/3o7TKSjRrfIPjeiVyM/giphy.gif)

* * *

### 🎁 What You Walk Away With

Check if you’re infected in 30 seconds. Clean your system. Then flip this paranoia into money with 6 side hustles that work THIS WEEK.

* * *

### 🧠 Why This Matters

- 100M+ downloads. If you use Notepad++, you might be compromised.
- 💀 6 months of silent backdoor access before anyone noticed.
- Supply chain attacks bypass antivirus — your “trusted” apps are the threat now.

* * *

> **📰 What Actually Happened**
>
> **The attack:** Chinese APT41 got into Notepad++'s update server. August 2025 to January 2026 — every auto-update came with free spyware.
> 
> **How it worked:** You clicked “update” thinking you’re getting security fixes. You were downloading government-grade surveillance tools.
> 
> **The damage:** 2-5 million devices. Remote access. Credential theft. Persistent surveillance.
> 
> **The embarrassing part:** No fancy zero-day exploit. They just… stole the update server password. Most “sophisticated attacks” are just bad password hygiene.

* * *

> **( ͡ಠ ʖ̯ ͡ಠ) Cool. My Text Editor Was a Spy. Now What's MY Move?**
>
> 1. **The “Panic Audit” Freelancer**
> 
> 2. **The “Clean USB” Reseller**
> 
> 3. **The “Update Manager” Subscription**
> 
> 4. **The “Breach Playbook” Template Seller**
> 
> 5. **The “Hash Checker” Bot**
> 
> 6. **The “Awareness Training” Package**

![money](https://media.giphy.com/media/67ThRZlYBvibtdF9JH/giphy.gif)

* * *

### ⚡ Too Long, What’s the Move?

Notepad++ was backdoored for 6 months. Check your version. Scan your system. Or better — sell “security audits” to panicking businesses while everyone’s scared.

* * *

_Source: [Ars Technica](https://arstechnica.com)_