Xubuntu.org Might Be Compromised

Note too, that NextDNS blocks archive.is et al by default unless you manually add redirects.

Whatta world

Would definitely recommend.

Also, don’t install the app? Use Sink It instead: https://gosinkit.com/

[1] https://doc.qubes-os.org/en/latest/project-security/verifyin...

Its not perfect... but its better than nothing.

Using Qubes would limit the blast radius for a scenario like this. In QubesOS, you would use disposable VMs (with no access to your crypto wallets or other user files) to download and flash an ISO. So even if this malware was targeting Linux, it wouldn't get zit and disappear when you finish flashing and shut down that VM (as long as there isn't an unpatched exploit breaking the VM isolation involved).

Of course, if the ISO is bad then this won't save you from compromise once you boot it. But that's not what happened here.

Indeed that is a suspicious or at least untrustworthy way to deflect the seriousness of a malware infection that potentially affects all users of an OS distribution.

You're making an assumption that this moderator is anything more than a Xubuntu enthusiast who wants to downplay outrage on Reddit. Keep in mind Xubuntu is mostly a community effort, not a large corporation with seniors who know how to handle this "best".

But nobody wants to talk about true security. For example, why does a Python module that renders progress bars (for example) need my full trust about what it does to the rest of my system? Etc.

... This is a thing?

This url is on the main Xubuntu website, under "Xubuntu 24.04": click "Release page," then select United States. From there, you download the following files: SHA256SUMS, SHA256SUMS.gpg, xubuntu-24.04.3-desktop-amd64.iso

The output of the other checksum commands is shown here:

[user@host]$ gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS

gpg: Signature made Thu 07 Aug 2025 06:05:22 AM CDT

gpg: using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092

gpg: Can't check signature: No public key

[user@host]$ sha256sum --check SHA256SUMS

xubuntu-24.04.3-desktop-amd64.iso: OK

(output omitted for results of Xubuntu minimal version, which was not downloaded)

The checksum is a cryptographic hash generated from the ISO file's contents. While the checksum for a specific, unchanged ISO file is fixed, the checksum that is published on a website could be deliberately altered by an attacker to hide a modified, malicious ISO.

Is there no way a download over HTTPS can be corrupted non-maliciously, or can fail to complete?

Lots of small, volunteer-run, low/zero-budget open-source projects cannot afford to pay for the server/CDN bandwidth they would need to host all their binary artifacts (ISOs, packages, etc.). They end up relying on mirrors provided for free by third parties instead. By publishing the checksums, they allow you to verify that the ISO image you downloaded from some mirror is the same one that they originally published.

It's a big bad dark scary Internet out there. Be careful.

They are empty as of now.

Instead of the .torrent files, the compromised website served a .zip file, which contained a .exe. When opened, it shows a GUI to select a Xubuntu version and a button to generate the link. When that button was clicked, the malware showed a download link to the user and, in the background, deployed a second stage to %APPDATA%\osn10963\elzvcf.exe and executed it.

The second stage monitors the clipboard for cryptocurrency addresses which it will replace with attacker-controlled ones. The second stage is also added to HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ to ensure it is run whenever the user logs in.

Both stages have some limited anti-debugging and anti-VM functionality.

I have not used unlock in years, since NoScript as a side-effect of not running scripts tends to block almost everything anyway (in particular ads), but maybe I should install it again after all for things like this.

uBO has prevented the following page from loading:

"FAKElubuntu.net I wont give backlinks too"

The page was blocked because of a matching filter in uBlock filters – Badware risks.