Notifications
Clear all
Topic starter
02/08/2026 12:03 pm
TL;DR: A supply chain attack against Notepad++ used compromised hosting infrastructure, stolen internal credentials, and selective traffic manipulation to deliver malicious updates and backdoors to a small set of targeted machines, according to Anomali's Cyber Watch. Update verification, host compromise, and credential persistence now define the real control problem, not just patch speed.
NHIMG editorial — based on content published by Anomali covering the Notepad++ supply chain attack: Anomali Cyber Watch on Notepad++, RAT uses Hugging Face, Microsoft Office flaw and more
By the numbers:
- Researchers identified three distinct infection chains deployed from July through October 2025, targeting approximately a dozen machines.
- The attackers retained stolen credentials to internal services enabling continued traffic manipulation until December 2, 2025.
Questions worth separating out
Q: What breaks when software update trust is compromised in a supply chain attack?
A: When update trust is compromised, normal patching workflows become a delivery mechanism for malicious code.
Q: Why do stolen service credentials make supply chain incidents harder to contain?
A: Stolen service credentials let attackers keep manipulating infrastructure after the first compromise is found.
Q: What do security teams get wrong about malicious software updates?
A: Teams often focus on the payload and miss the trust path that delivered it.
Practitioner guidance
- Inventory update-path credentials Map every credential, token, and internal account that can publish, host, or redirect software updates.
- Enforce signature validation at execution time Require downloaded installers and packages to be validated on the endpoint before first execution, not only at source publication.
- Rotate internal service credentials after infrastructure compromise If a hosting provider or update server is breached, treat all related internal service credentials as potentially exposed.
What's in the full analysis
Anomali's full post covers the operational detail this post intentionally leaves for the source:
- Timeline detail on the hosting compromise, credential theft, and the dates on which the attackers lost and retained access.
- The three infection chains and the specific payload-delivery mechanisms used in each chain.
- The version and verification changes Notepad++ applied after the incident, including certificate and signature validation.
- The published indicators of compromise that security teams can use for endpoint and traffic review.
👉 Read Anomali's cyber watch analysis of the Notepad++ supply chain attack →
Notepad++ supply chain attack: what it means for trust and updates?
Explore further
02/08/2026 1:08 pm
Update trust is now an identity and access problem, not just a software integrity problem. The Notepad++ case shows that compromise did not depend on a single exploit path. It depended on trusted infrastructure, stolen internal credentials, and execution through legitimate update tooling. That combination exposes a governance gap that sits between endpoint security and identity control. Practitioners should treat software delivery credentials, hosting access, and updater trust as part of the access model.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when an update infrastructure breach exposes users to malicious code?
A: Accountability usually spans the software publisher, the hosting or distribution provider, and the internal teams that own update credentials and validation controls. NIST CSF and NIST 800-53 both point to clear asset ownership, access control, and monitoring responsibilities. If those lines are unclear, remediation slows and exposure lasts longer.
👉 Read our full editorial: Notepad++ supply chain attack shows update trust is the weak link
