Warning: Xubuntu Website Compromised to Deliver Malware

The official Xubuntu website appears to have been compromised, with the site’s official torrent download replaced by a ZIP archive containing a malicious Windows executable (EXE) designed to lure users into running it. A VirusTotal scan revealed that the executable was flagged as malware or a backdoor by 32 different security engines. Following user reports, the Xubuntu team promptly removed the compromised download link from the website.

Some users tested the file in a virtual machine; on execution it briefly opened a Windows Command Prompt window before launching what seemed to be a legitimate Xubuntu GUI installer, a tactic likely intended to disguise the malware’s background activity.

The piece notes a recent surge in supply chain–style attacks targeting cryptocurrency assets and suggests it is highly plausible the malicious program was designed to search for and steal cryptocurrency wallets and other financial information from infected systems, though no technical analysis from cybersecurity firms had yet been published.