Xubuntu, the Ubuntu-based Linux distribution using the Xfce desktop environment, had its downloads page compromised to deliver cryptocurrency-stealing malware, The Register reports.
Multiple reports on Reddit, including the Xubuntu subreddit, noted that torrents downloaded from Xubuntu's website included a ZIP file with a dubious executable and tos.txt file, with the former not havign a .torrent file and the latter having a suspicious copyright dated 2026.
Further analysis of the 'Xubuntu Safe Downloader' Windows app showed an improper software license. Another report on Reddit noted the installer to launch a cryptocurrency clipper payload, which saves an executable to AppData Roaming before proceeding with registry key configuration for persistence and startup execution.
Actual cryptocurrency exfiltration as a result of the malware has not been observed so far. Xubuntu has also disabled its downloads page while addressing the issue.
"We're in the process of migrating to a static environment which should make things like this a thing of the past, but our team is quite small and busy," said Xubuntu on Reddit.
Multiple reports on Reddit, including the Xubuntu subreddit, noted that torrents downloaded from Xubuntu's website included a ZIP file with a dubious executable and tos.txt file, with the former not havign a .torrent file and the latter having a suspicious copyright dated 2026.
Further analysis of the 'Xubuntu Safe Downloader' Windows app showed an improper software license. Another report on Reddit noted the installer to launch a cryptocurrency clipper payload, which saves an executable to AppData Roaming before proceeding with registry key configuration for persistence and startup execution.
Actual cryptocurrency exfiltration as a result of the malware has not been observed so far. Xubuntu has also disabled its downloads page while addressing the issue.
"We're in the process of migrating to a static environment which should make things like this a thing of the past, but our team is quite small and busy," said Xubuntu on Reddit.
