HN Reader

the malware's main function seems to be to check the clipboard for crypto wallet addresses and then replace them with attacker addresses:

  Bitcoin (bc1): bc1qrzh7d0yy8c3arqxc23twkjujxxaxcm08uqh60v
  Litecoin (ltc1/L/M): LQ4B4aJqUH92BgtDseWxiCRn45Q8eHzTkH
  Ethereum (0x): 0x10A8B2e2790879FFCdE514DdE615b4732312252D
  Dogecoin (D): DQzrwvUJTXBxAbYiynzACLntrY4i9mMs7D
  Tron (T): TW93HYbyptRYsXj1rkHWyVUpps2anK12hg
  Ripple (r): r9vQFVwRxSkpFavwA9HefPFkWaWBQxy4pU
  Cardano (addr1): addr1q9atfml5cew4hx0z09xu7mj7fazv445z4xyr5gtqh6c9p4r6knhlf3jatwv7y72deah9un6yettg92vg8gskp04s2r2qren6tw

can't guarantee it doesn't do anything else.

I ran the checksum for the current ISO file of the full Xubuntu desktop version on the Xubuntu website, and the checksum appears to be valid.

https://mirror.us.leaseweb.net/ubuntu-cdimage/xubuntu/releas...

[user@host]$ ls

SHA256SUMS SHA256SUMS.gpg xubuntu-24.04.3-desktop-amd64.iso

[user@host]$ cat SHA256SUMS

b61e083d8a5ab003bad6ef7ea31ec21d7bfdf19b99d75987ab3fa3bbe85ec1bf *xubuntu-24.04.3-desktop-amd64.iso

[user@host]$ sha256sum xubuntu-24.04.3-desktop-amd64.iso

b61e083d8a5ab003bad6ef7ea31ec21d7bfdf19b99d75987ab3fa3bbe85ec1bf xubuntu-24.04.3-desktop-amd64.iso

[user@host]$ echo $?

0

There's a sticked comment on the source thread: https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg...

What scared me in that thread was the mention of the fake lubuntu site that is still up since someone took over the old domain last year(?). I downloaded and installed lubuntu just some week ago. Luckily I am pretty sure I downloaded it from the real site. The fake one only has downloads up to 19.04 or something.

Have not installed Lubuntu in a few years, so never noticed any of the news of the domain change and take-over. Did not really find anything more about it when searching today?

oddly, the one "sus" thing flagged -- a " (C) 2026 " late in 2025 -- is consistent with practices of established book publishers.

I recall purchasing a textbook in September of year X and being surprised that it was "from the future" with a "Copyright X+1".

This should lead to better checksum verification mechanism, because if you compromise the site, you can put whatever compromised checksum as well. I think having a centralized checksum verification system for all major (or all) distributions would be a good start.

With these reports, I always wonder - do people really keep their software wallets on a machine they use every day? Personally I keep it on a laptop that is used just for that and it never occurred to me any other options is viable.

Somebody did sneak a wayland compositor for xfce???

:P

fortunately, in this case, it seems like the malware may be moot if you use the iso to wipe your windows installation...

"Linux doesn't get viruses"

Since Xubuntu inception a decade ago, facts certainly have changed!

Let's not kid ourselves. A state level actor who is playing the long game can compromise any distro, package, etc. without us knowing about it.

That is why I use Qubes OS [1] in order to have a certain peace of mind.

[1] https://www.qubes-os.org/

EDIT: further comment below:

On second thought, Qubes OS does not prevent such types of malicious downloads; it can also happen to Qubes images. Verify your downloads with checksums and cryptographic signatures [2].

[2] https://doc.qubes-os.org/en/latest/project-security/verifyin...