Xubuntu Website Compromised, Served Malware Downloads

[lokamoka820]

Content source

https://www.omgubuntu.co.uk/2025/10/xubuntu-website-malware-hack

The official Xubuntu website was compromised over the weekend (18/19 October 2025) briefly serving up Windows malware to users trying to download the distro.

Users who visited the Xubuntu website over the weekend to download the official .torrent of the Xfce-toting Ubuntu flavour instead got a xubuntu-safe-download.zip.

When the rogue zip file was extracted it contained an .exe runtime and a ‘terms of service’ text file.

The Xubuntu team took down the affected download page as soon as they were informed. There is no indication that direct Xubuntu ISO downloads (or checksums) were modified, altered, replaced or otherwise interfered with.

The malicious download link appears to have been live for a day or two at most. Wayback Machine snapshots from 11 October point to the .torrent file, but the 18 October snapshot offers the malicious .zip instead.

 

[Wrecker4923]

This is: expecting an ISO file to install the distro, but geting a ZIP file instead.

Still better than the 2016 Linux Mint's hacked ISO file.

 

[Zero Knowledge]

Hard to combat this attack from the official site. But surely a .zip file would set off a alarm or two?

 

[Wrecker4923]

Here's the reddit post that first noticed the problem. He said VT picked this up, but didn't say if this happened a day ago or 15 hours ago (when he last edited). This image is identical to the current analysis (26 positive).

Notable absences for me are: Avast, ESET, Kaspersky, and Sophos. And according to this post, McAfee and Crowstrike didn't pick this up as fast as MD either.



Haha, can't even assume that these are Linux guys; they can't get hacked.

 

[Khushal]

Here's the reddit post that first noticed the problem. He said VT picked this up, but didn't say if this happened a day ago or 15 hours ago (when he last edited). This image is identical to the current analysis (26 positive).

Notable absences for me are: Avast, ESET, Kaspersky, and Sophos. And according to this post, McAfee and Crowstrike didn't pick this up as fast as MD either.

View attachment 292143

Haha, can't even assume that these are Linux guys; they can't get hacked.

file has antivm characteristics

 

[Khushal]

 

[Shadowra]

I have the sample, it's a Clipper that replaces a BTC wallet with its creator's wallet in the clipboard.
The PUP isn't detected very often, but the EXE is detected much more frequently (by Bitdefender, Avast, and Kaspersky, for example).