Threat Actors Compromise Xubuntu Website to Distribute Malicious Windows Executable

In mid-October, attackers breached the official Xubuntu website and manipulated its torrent download links.

Instead of the genuine .torrent files for the lightweight Ubuntu variant with the Xfce desktop, visitors were served a ZIP archive named “Xubuntu-Safe-Download.zip”.

Inside this archive was a suspicious Windows executable, “TestCompany.SafeDownloader.exe,” accompanied by a misleading “tos.txt” file falsely claiming a 2026 copyright from “Xubuntu.org.”

The compromise, uncovered on October 18, 2025, underscores growing risks facing community-maintained Linux distribution sites.

As Windows 10 reached end-of-support on October 14, many users sought alternative operating systems and turned to user-friendly distros like Xubuntu.

However, cybercriminals appear to have targeted these newcomers with a Trojan designed to steal cryptocurrency.

Reddit Users Sound the Alarm

Alert members of the r/xubuntu and r/Ubuntu communities first noticed the anomaly on the xubuntu.org download page.

of pointing to legitimate torrent files, the page redirected visitors to download the malicious ZIP file.

The forged copyright notice in the “tos.txt” file raised immediate suspicions, prompting security researchers to examine the contents more closely.

Security analysts submitted the ZIP’s executable to VirusTotal, where over a dozen antivirus engines flagged it as a trojan.

The malware exhibited classic persistence techniques by writing registry entries on Windows systems.

When executed in sandbox environments, the fake downloader appeared to install Xubuntu but actually dropped a second payload, “zvc.exe,” into the user’s AppData folder.

This payload hijacked the clipboard: whenever a user copied a cryptocurrency wallet address, the malware replaced it with an attacker-controlled address, enabling undetected theft during transactions.

Windows Focus Exploits Migrating Users

The clipper’s Windows-only design suggests the attackers aimed at users migrating from unsupported Windows 10.

Many of these users, uneasy about hardware requirements for Windows 11, had opted for Xubuntu’s lightweight interface.

The simple interface of the fake downloader likely reassured non-technical users, while the outdated licensing references revealed the site’s lax security.

Xubuntu maintainers, led by Sean Davis, reacted swiftly upon confirmation of the breach.

The compromised download page was disabled within hours, and direct ISO links hosted on Ubuntu’s official servers remained secure.

Users were advised to verify ISO checksums and only download from canonical sources. Davis highlighted that the site ran an outdated external WordPress instance, complicating rapid fixes.

He pledged to accelerate the transition to a static site for future resilience.

Community contributor Elizabeth Krumbach Joseph called the incident a “slip-up” in hosting upgrades.

She joined Davis in urging ubuntu.com to temporarily remove Xubuntu links to prevent further confusion. Based on archived snapshots, the malicious link was active for only 24 to 48 hours.

To date, no confirmed infections or cryptocurrency losses have been reported.

The episode serves as a stark reminder that even well-known open-source projects must maintain rigorous security practices to protect users.

Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today