Notepad++ supply chain attack shows update trust is the weak link

At a glance

What this is: A Notepad++ supply chain attack abused hosting compromise and stolen internal credentials to selectively redirect update traffic and deliver malicious installers to targeted victims.

Why it matters: It matters because software update trust now depends on host integrity, internal credential control, and signature verification, not just on whether users install the latest version.

Context

Update channels are a governance problem as much as a software problem. When an attacker can tamper with hosting, retain internal credentials, and selectively redirect only some users, normal patching assumptions collapse because the delivery path itself has become the attack surface.

This incident sits at the intersection of supply chain security and identity governance. The exposed trust boundary was not just the updater binary, but the combination of hosting access, internal service credentials, and verification gaps that let malicious installers appear legitimate to targeted systems.

Key questions

Q: What breaks when software update trust is compromised in a supply chain attack?

A: When update trust is compromised, normal patching workflows become a delivery mechanism for malicious code. Signed packages, automatic updaters, and routine maintenance channels all lose reliability if attackers can alter the path, the payload, or the validation step. Defenders then have to assume that the software source, not just the endpoint, is part of the incident.

Q: Why do internal service credentials matter in supply chain attacks?

A: Internal service credentials matter because they can keep an attacker inside the update process even after the original host compromise is repaired. If those credentials are not revoked quickly, the attacker may still manipulate publishing, routing, or content delivery without re-compromising the server.

Q: What are the signs that update traffic is being selectively manipulated?

A: Look for update requests that behave differently by geography, IP range, user group, or timing, especially when only a small set of systems receives altered installers. Selective manipulation often leaves inconsistent delivery patterns rather than broad malware distribution, which is why simple volume-based alerts miss it.

Q: Should organisations verify update provenance before or after installation?

A: Before installation. If provenance checks happen only after the file has already executed, the attacker has already crossed the trust boundary. Verification needs to cover the signed package, the source channel, and the publishing identity so the system can reject tampered content before it runs.

Technical breakdown

How compromised hosting turns update trust into an entry path

Software update systems assume that the server delivering the package is trustworthy. When attackers compromise shared hosting or adjacent infrastructure, they can intercept requests, redirect downloads, or alter installer content before the user ever sees a signed payload. In this case, the problem was not only malware distribution, but abuse of the delivery channel itself. That creates a control gap between package publication and package retrieval, where normal endpoint defences may see only a legitimate-looking installer. For identity and NHI teams, the deeper lesson is that service credentials protecting content delivery are part of the trust boundary, not just infrastructure plumbing.

Practical implication: treat update infrastructure credentials and hosting controls as security-critical assets, not operations-only dependencies.

Why stolen internal credentials extend the compromise window

A direct server compromise can end while the attacker’s access does not. If internal service credentials remain valid after the initial foothold is removed, the attacker can continue manipulating traffic, preserving selective delivery or redirecting only specific targets. That is a classic persistence pattern: the infrastructure is remediated, but the identity that enabled the abuse still exists. For NHI governance, this is the point where lifecycle control matters most, because machine and service credentials often outlive the system that first exposed them. The campaign shows how credential persistence can sustain a supply chain attack long after the visible host compromise is fixed.

Practical implication: rotate and revoke internal service credentials as part of incident containment, not as a later cleanup task.

How selective targeting and chain rotation complicate detection

The attackers did not rely on a single payload or one delivery method. They rotated command-and-control infrastructure, changed infection chains, and used selective traffic filtering to limit exposure to chosen victims. That pattern reduces noise, frustrates hash-based detection, and makes broad compromise indicators less useful because only a narrow set of hosts receives the malicious content. This is why supply chain incidents often evade basic telemetry until the attacker has already achieved persistence. In governance terms, the problem is not just malicious code, but the attacker’s ability to control who sees it and when.

Practical implication: combine update telemetry, certificate validation, and threat hunting for delivery anomalies rather than relying on signature matches alone.

Threat narrative

Attacker objective: The attacker objective was to insert trusted-looking malicious updates into a software distribution path and maintain selective access long enough to deploy backdoors to chosen targets.

1. Entry occurred when attackers compromised the shared hosting provider behind the Notepad++ update path and used that foothold to intercept or redirect update traffic.
2. Credential access and persistence followed through stolen internal credentials that remained usable after the hosting server was repaired, allowing continued manipulation of targeted delivery.
3. Impact came from selectively delivering malicious NSIS installers through the legitimate updater to a small set of victims, including backdoors and loader chains.

Breaches seen in the wild

• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
• Palo Alto Networks Salesforce data theft 2025: Stolen Drift OAuth tokens exposed Palo Alto Networks CRM data, including support notes where some customers had shared credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Update trust is now a compound control problem, not a single verification step. This attack worked because the delivery chain included hosting integrity, credential persistence, and package validation, any one of which could be subverted. When those controls are treated as separate operational concerns, attackers only need to defeat one weak link to reach the endpoint. Practitioners should manage update trust as an end-to-end governance domain.

Credential persistence is the hidden failure mode in supply chain incidents. The visible host compromise was repaired, but the retained internal credentials kept the attacker inside the delivery process. That failure mode matters for NHI governance because service credentials often outlive infrastructure events and are rarely revoked with the same urgency as interactive accounts. Practitioners should treat internal credentials as revocation-first assets during containment.

Selectivity is a detection bypass, not a sign of low risk. The campaign targeted only a small number of machines, which can lead teams to underestimate the control gap. In reality, selective filtering is a mature attacker technique that reduces telemetry and hides in plain sight. The lesson is that narrow blast radius does not mean limited security significance; it often means the attacker is being careful.

Update verification gaps create supply chain trust debt. When certificate or signature checks are optional, delayed, or incomplete, organisations accumulate a trust debt that attackers can spend during a hosting compromise. That debt becomes visible only when a malicious installer still looks legitimate enough to run. Practitioners should close that gap before they standardise on another update path or third-party hosting arrangement.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: CI/CD Pipeline Identity Security Guide

What this signals

Selective delivery is the important clue here. Attackers who compromise update infrastructure often avoid mass infection because a small victim set is easier to control and harder to detect. For practitioners, that means telemetry must look for route manipulation, not just malware counts, because a narrow campaign can still expose the most sensitive systems.

Update trust debt accumulates when verification is optional. Once organisations accept installer delivery from a path they have not fully governed, they create a standing exposure that only becomes visible during a hosting compromise. Closing that gap means treating software distribution as part of identity and access control, especially where internal credentials and external hosting intersect.

For practitioners

• Harden software update delivery paths Require certificate and signature verification for all downloadable installers and enforce the check before execution, not after download.
• Inventory custom update mechanisms Identify applications that use their own updater, separate from central patching tools, and classify the hosting dependencies behind each one.
• Revoke internal service credentials during containment Include internal service accounts, tokens, and admin access used for hosting or update publishing in every incident response revocation list.
• Monitor for selective delivery anomalies Look for update traffic that varies by source IP, geography, or user group, because selective redirection often indicates attacker-controlled filtering.
• Validate installer provenance before deployment Confirm that installers are signed, match expected hashes, and originate from the approved distribution path before they reach production endpoints.

Key takeaways

• The incident shows that supply chain compromise is often a trust problem across hosting, credentials, and package verification rather than a simple malware delivery problem.
• Selective targeting and persistence through internal credentials made the attack harder to detect and more durable than a one-time server compromise.
• Strong provenance checks, rapid credential revocation, and controlled update hosting are the controls that would have narrowed or broken the attack path.

Key terms

• Software Supply Chain Compromise: A software supply chain compromise is an attack that inserts malicious code into trusted build, package, or deployment paths. The goal is often not immediate application failure, but secret theft, persistence, or unauthorized changes that travel downstream through automated systems.
• Update Trust: Update trust is the assurance that a firmware or software update is authentic, intended for the right device, and safe to apply. It depends on signing, validation, and inventory linkage so patching does not become a blind spot in the device lifecycle.
• Credential Persistence: Credential persistence is the ability of an attacker to keep access after the original secret is revoked or the initial malware is removed. In identity terms, it usually means a second credential, key, or token has been added to the account lifecycle and now survives the first response action.
• Targeting: Targeting is the practice of deciding which users, accounts, or organizations receive a feature or change. It allows teams to release functionality incrementally instead of all at once. In operational terms, targeting controls exposure, supports gradual rollout, and creates an audit trail for who was included or excluded.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity control to the broader security programmes that depend on trusted delivery and access.