Over the course of six days — from May 6 to May 12, 2026 — the official Linux builds of the popular Wii U emulator Cemu version 2.6 were compromised. Instead of the clean program, users downloaded malware that stole passwords, SSH keys, GitHub tokens, and credentials for cloud services. The attackers managed to replace binary files in the official GitHub project repository.
Users who downloaded and launched the following are at risk:
- Cemu-2.6-x86_64.AppImage (portable package)
- cemu-2.6-ubuntu-22.04-x64.zip (archive for Ubuntu)
Important: The Flatpak version of the emulator, as well as the Windows and macOS builds, were not affected by the attack.
Cemu is a popular Nintendo Wii U emulator that allows users to run exclusive games such as The Legend of Zelda: Breath of the Wild on personal computers. The project was created in 2015 by Dutch developer Exzap and initially existed only for Windows. A turning point came in 2022 when Cemu opened its source code under the MPL 2.0 license, attracting new contributors and enabling the emulator to be ported to Linux and macOS. Today, Cemu is written in C++ and is capable of emulating not only the main console but also the GamePad, Pro Controller, and supports input from keyboards and gamepads.
Details of the incident:
- Attack vector: The attack occurred at the supply chain level. One of the project contributors accidentally ran a compromised Python package, which led to the theft of their GitHub access token. Using this token, the attackers automatically replaced the 'clean' release files with malicious ones.
- Target audience: The code primarily targets developers and DevOps engineers. The malware steals authentication data for cloud providers, version control systems, and CI/CD.
- Israeli 'surprise': A destructive module for Israeli users has been identified. If the system determines based on locale and timezone that it is in Israel, there is a 1 in 6 chance that a loud siren will play and the command rm -rf / will execute, attempting to destroy all data on the disk.
- Scale: According to preliminary estimates, the infected files may have been downloaded nearly 20,000 times.
What to do
- Reset everything: Be sure to change all important passwords, revoke and regenerate SSH keys and GitHub tokens that were stored on the compromised system.
- If you ran a compromised version, the safest way is to reinstall the operating system.
- The absence of obvious signs of infection does not guarantee safety. The malware quietly steals data, and the full extent of its capabilities remains unknown.
Source: linux.org.ru
