Xubuntu's Official Download got Compromised
Posting to spread the word and possibly help someone that may be affected.
View original on lemmy.world
Syndicated from the fediverse. Read and engage on the original instance.
View original on lemmy.world
9 replies
Good idea to remember not to click zips or exes if you're expecting a torrent file.
Luckily this malware was relatively benign, changing bitcoin addresses to malicious ones in the clipboard, so if you don't use crypto then you're fine against this attack. No one's funds have made it into the attacker's wallet yet.
Official Download or official Downloader?
In other words, what was compromised, the .iso itself or the Windows .exe seen in the screenshot?
Just look at the video...
The download from their official site that would normally give you a .torrent file that would get you a .iso file if you torrented it was replaced with a .exe file instead. So windows users trying to install xubuntu would have their systems compromised if they were unaware of how its supposed to work.
Is there a link that isn't a fucking video?
https://www.omgubuntu.co.uk/2025/10/xubuntu-website-malware-hack
https://archive.ph/iVyD2
At this point, probably.
Quite a bad compromise of Xubuntu's and Canonical's security and also embarrassing.
They're being a bit vague and dismissive of the hack at the moment, as far as I can see there is now only the 24.04 version linked on the downloads page (not even sure the download link works). The recent 25.10 release (released 10th Oct) is no longer visible and the blog posts visible talk about testing for 21.04 (posts from 2021).
So presumably they've reverted to an archived version of their site while they investigate?
The download page is completely unreachable right now for me. Some parts of the website just throw 503 errors.