Thanks for the alert!

I have removed the compromised releases. The uploader is the account of the long term co-author of Cemu. As an immediate measure I have removed their access to the repo and reached out to him to clarify how exactly this could have happened. Thanks again for reporting this. Will investigate further

Update: Files have been restored to a good version. If you downloaded either the Ubuntu or AppImage version of Cemu 2.6 between 6th May and the time this issue was posted then you are affected. In this case read my my second response in this issue

How screwed am I if I downloaded and ran AppImage today prior to being taken down?

From preliminary analysis it seems that mostly it is trying to spread itself rather than cause direct damage, it does that by stealing SSH keys, github tokens and a lot of other passwords or keys that they can then use to infect more packages or software releases. This is likely also how we got affected. The other Cemu author (MangleSpec/Petergov) ran software in WSL which was compromised through which they got hold of his github token. At least that is our leading theory.

HOWEVER if your region is Israel (it detects this via keyboard layout and timezone settings), then it will have a random chance to wipe your filesystem (subprocess.run(["rm", "-rf", "/*"])) every time you start the compromised software.

So my immediate advice is this:

1. Delete the compromised Cemu files (Cemu-2.6-x86_64.AppImage and cemu-2.6-ubuntu-22.04-x64.zip). Note: You are not affected if you downloaded before 6th May.
2. Reset all your passwords, ssh keys and service tokens
3. Block IP 83.142.209.194 just in case. This is hardcoded and used as a remote endpoint

In our case it's the Linux releases Cemu-2.6-x86_64.AppImage and cemu-2.6-ubuntu-22.04-x64.zip that got compromised. Windows and MacOS releases are unaffected as well as the flatpak version of Cemu. The compromised ubuntu and appimage zip have been online for 5-6 days (they were taken offline 10 minutes after this issue was posted and I am in the process of restoring the good files).

More info: https://teampcp.cyberdigest.international/

this is actually the same attack : https://fxtwitter.com/MsftSecIntel/status/2054041471280423424
same behavior against israeli users, same IP

and this recent supply chain attack also used transformers as part of the payload, so maybe related idk ?
https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/

Would it be a good idea to bump the release number of the restored AppImage to trigger installers like emudeck to re-download it?

Would a user be meaningfully affected if they had EmuDeck download the affected AppImage as part of a mass update but never ran Cemu between then and now?

subprocess.run(["rm", "-rf", "/*"])

If this was the exact command it would have failed because you'd need --no-preserver-root lmao

Would a user be meaningfully affected if they had EmuDeck download the affected AppImage as part of a mass update but never ran Cemu between then and now?

I would like to know as well

subprocess.run(["rm", "-rf", "/*"])

If this was the exact command it would have failed because you'd need --no-preserver-root lmao

It runs rm -rf /* which the glob is expanded by the shell to every directory/file in /

So it runs rm -rf /bin /lib /usr /home /var /etc, etc

I assume it runs this as the user that executed the malware and not as root, which means it only deletes what your user has write access to. Similar to the infamous Steam bug. Worst case scenario you delete all your backups and external drives if you had them mounted.

Would a user be meaningfully affected if they had EmuDeck download the affected AppImage as part of a mass update but never ran Cemu between then and now?

Yes you would have a compromised version of Cemu which you should uninstall immediately. No you aren't affected if you didn't open the file.

subprocess.run(["rm", "-rf", "/*"])

If this was the exact command it would have failed because you'd need --no-preserver-root lmao

It runs rm -rf /* which the glob is expanded by the shell to every directory/file in /

So it runs rm -rf /bin /lib /usr /home /var /etc, etc

I assume it runs this as the user that executed the malware and not as root, which means it only deletes what your user has write access to. Similar to the infamous Steam bug. Worst case scenario you delete all your backups and external drives if you had them mounted.

Not sure about the implementation of subprocess.run(), but theres also a chance that there is no glob expansion since that would require the command to be run in a shell that does it.

Would it be a good idea to bump the release number of the restored AppImage to trigger installers like emudeck to re-download it?

EmuDeck contributor here, as far as I'm aware, we are using the version that is deemed non-compromised by the Cemu developers, We are not aware of the extent of how many EmuDeck users are affected however, please make sure to check the SHA256 hash and compare it to the one provided by the Cemu developers prior to hitting the "Reinstall/Update" button in Cemu's page via the Manage Emulators tab.
The good SHA256 hash provided by the devs is 0c20c4aeb800bb13d9bab9474ef45a6f8fcde6402cad9b32ac2a1bbd03186313, you can check this by going to Home/Applications, right click Cemu.AppImage, Properties, Checksums tab, then copy and paste the hash provided into the field to make sure they match, you may need to calculate the SHA256 hash first however.

Is it also possible that the Proton version of 2.6 (Yes, i ran that version by accident through Emudeck) is affected in any way? I know it's the Windows version, but i want to ask just in case. I don't have the Linux versions installed, as far as i'm aware of.

@yokozeki-rabbit As Exzap said, Windows versions were not affected by the malware, just the native Linux AppImage version as far as what we use with EmuDeck goes, if you used the Windows version, you aren't affected.

I use Emudeck and ES-DE and it says the last time I played a Wii U game was 174 days ago so I'm good right?

@naruto020499 I would still recommend you check the Hash just in case because it is not difficult to check, instructions are provided in my above comment, and EmuDeck typically does not update emulators by itself without your permission, so it's likely you were not affected, but I would still check to make sure.

Would it be a good idea to bump the release number of the restored AppImage to trigger installers like emudeck to re-download it?

EmuDeck contributor here, as far as I'm aware, we are using the version that is deemed non-compromised by the Cemu developers, We are not aware of the extent of how many EmuDeck users are affected however, please make sure to check the SHA256 hash and compare it to the one provided by the Cemu developers prior to hitting the "Reinstall/Update" button in Cemu's page via the Manage Emulators tab.
The good SHA256 hash provided by the devs is 0c20c4aeb800bb13d9bab9474ef45a6f8fcde6402cad9b32ac2a1bbd03186313, you can check this by going to Home/Applications, right click Cemu.AppImage, Properties, Checksums tab, then copy and paste the hash provided into the field to make sure they match, you may need to calculate the SHA256 hash first however.

Is it also possible that the Proton version of 2.6 (Yes, i ran that version by accident through Emudeck) is affected in any way? I know it's the Windows version, but i want to ask just in case. I don't have the Linux versions installed, as far as i'm aware of.

As Exzap said, Windows versions were not affected by the malware, just the native Linux AppImage version, if you used the Windows version, you aren't affected.

I use Emudeck and ES-DE and it says the last time I played a Wii U game was 174 days ago so I'm good right?

I would still recommend you check the Hash just in case because it is not difficult to check, instructions are provided in my above comment, and EmuDeck typically does not update emulators by itself without your permission, so it's likely you were not affected, but I would still check to make sure.

My hash was d07a29c4458d00e42d5d9e6345932592e91644d6b821bacdb7a543c628e0b41a but I haven't played in 174 days. I also already took your advise from the discord and reinstall/updated in the Emudeck app and still haven't launched a game. My new hash is the clean one 0c20c4aeb800bb13d9bab9474ef45a6f8fcde6402cad9b32ac2a1bbd03186313.

My hash was d07a29c4458d00e42d5d9e6345932592e91644d6b821bacdb7a543c628e0b41a but I haven't played in 174 days. I also already took your advise from the discord and reinstall/updated in the Emudeck app and still haven't launched a game. My new hash is the clean one 0c20c4aeb800bb13d9bab9474ef45a6f8fcde6402cad9b32ac2a1bbd03186313.

If you know you haven't ran the infected version before installing the non-infested version, then I would believe that you are fine, but if you did or don't know if you did, you should proceed with the FAQ steps provided by the Cemu devs as a make sure, ES-DE doesn't keep track of all instances of when the emulator was opened, only when it was opened through ES-DE.

so to clarify, if i run the shasum -a 256 command, and check the hash, if it comes up as 0c20c4aeb800bb13d9bab9474ef45a6f8fcde6402cad9b32ac2a1bbd03186313 , the user should be fine, and anything is malware

My hash was d07a29c4458d00e42d5d9e6345932592e91644d6b821bacdb7a543c628e0b41a but I haven't played in 174 days. I also already took your advise from the discord and reinstall/updated in the Emudeck app and still haven't launched a game. My new hash is the clean one 0c20c4aeb800bb13d9bab9474ef45a6f8fcde6402cad9b32ac2a1bbd03186313.

If you know you haven't ran the infected version before installing the non-infested version, then I would believe that you are fine, but if you did or don't know if you did, you should proceed with the FAQ steps provided by the Cemu devs as a make sure, ES-DE doesn't keep track of all instances of when the emulator was opened, only when it was opened through ES-DE.

If I do that does it delete everything off my Steam Deck or is there a way to keep my files? Cause I have no idea which of my Steam games don't have cloud saves on my Steam Deck.

If I do that does it delete everything off my Steam Deck or is there a way to keep my files? Cause I have no idea which of my Steam games don't have cloud saves on my Steam Deck.

You should back up any important files to a different drive, roms, saves, etc, as yes, it will remove files by doing a reinstall of the OS.

so to clarify, if i run the shasum -a 256 command, and check the hash, if it comes up as 0c20c4aeb800bb13d9bab9474ef45a6f8fcde6402cad9b32ac2a1bbd03186313 , the user should be fine, and anything is malware

Yes, that hash number is deemed as the non-infected version.

Yes you would have a compromised version of Cemu which you should uninstall immediately. No you aren't affected if you didn't open the file.

And just to be sure, is there nothing EmuDeck does as part of its functions (e.g. installing emulators, updating configs, checking BIOSes, adding games to the Steam library via SRM, etc) that would cause the compromised Cemu to silently execute and deliver its payload in any way, outside of the user actually running the emulator or a game that uses the emulator themselves?

Yes you would have a compromised version of Cemu which you should uninstall immediately. No you aren't affected if you didn't open the file.

And just to be sure, is there nothing EmuDeck does as part of its functions (e.g. installing emulators, updating configs, checking BIOSes, adding games to the Steam library via SRM, etc) that would cause the compromised Cemu to silently execute in any way, outside of the user actually running the emulator or a game that uses the emulator themselves?

Using SRM Shortcuts and ES-DE/Pegasus frontends to launch a game that uses Cemu will indeed launch the malware if it is the infected version, people should check the AppImage file's hash first above all else to make sure it matches the non-infected version before running any Wii U games via any of the methods EmuDeck provides.

None of EmuDeck's scripts contain malware to my knowledge, nor should they execute any AppImage without user intervention, but this would be a question more suitable to DragoonDorise or JDavid, as I'm not the best coder. You can always check yourself of course, EmuDeck is open sourced on Github.

By the way: this is why it is better to distribute a properly sandboxed application (ie a Flatpak that doesn't have --filesystem=host:ro enabled, and a MacOS app that has com.apple.security.app-sandbox enabled).

Then it wouldn't be able to snoop around your home directory, or run rm -rf on things outside the sandbox.

Using SRM Shortcuts (...) to launch a game that uses Cemu will indeed launch the malware if it is the infected version

By which you mean actually running the shortcut to launch the game will launch the malware, correct? And that simply creating the shortcut alone will not run the malware, and to the best of your knowledge neither will any other functions of EmuDeck short of the user themselves actually explicitly launching Cemu/a game that uses Cemu. Apologies for probably asking the obvious.

In my case I have, during the period while the appimage download was compromised, updated Cemu using EmuDeck, updated all emulator configs, and run SRM to update shortcuts, but not actually launched Cemu directly or launched any games that use Cemu via SRM shortcuts or a frontend. I have, after this was announced, now updated again and verified that the hash now matches the clean version. I'm just trying to make absolutely sure that I haven't missed something before I forego doing a more extensive cleanup and resetting all passwords.

bad news is that i was running the infected version, id reccomend broadcasting this when confirmed. second thing is that im not entirely sure what im meant to do

Where is that python snippet from

It's from the payload that it downloads from the CnC server and installs as a daemon that launches on startup. It's basically a selective mix of the original entrypoint and roulette file, I think they realised their mistake and tried to bypass --no-preserve-root with shell wildcard expansion, which as others pointed out is not enabled when subprocess.run does not have shell=True as an argument.

By which you mean actually running the shortcut to launch the game will launch the malware, correct? And that simply creating the shortcut alone will not run the malware, and to the best of your knowledge neither will any other functions of EmuDeck short of the user themselves actually explicitly launching Cemu/a game that uses Cemu. Apologies for probably asking the obvious.

Launching a game via the shortcut will launch the malware, yes. Merely creating the SRM shortcut will not run the malware, it's the act of using the shortcut, because it will then boot up Cemu.AppImage

The other functions of EmuDeck should not touch the AppImage at all.

So TL;DR

• BIOS Checker is safe (Largely irrelevant as we don't check for Cemu's encryption keys/no firmware is required for Cemu)

• Emudeck Cemu Installation is safe (checked it myself via hash comparison, and Exzap removed the malware infested version so it wouldn't be given to users now anyway as we pull from this GitHub repository)

• Configs are handled via Linux commands, and to my limited knowledge, it never touches the AppImage and only modifies files related to configs directly, the only script that does is the launcher script for, well, obvious reasons, and this launcher script is only executed when the user launches a game via SRM, ES-DE, or Pegasus as mentioned earlier.

As stated I'm not well equipped to answer these questions with 100% certainty, this is what I can make of the code from my limited expertise.

but why Linux and not windows or Android build ?

but why Linux and not windows or Android build ?

Idk maybe they thought it would take them longer to notice... Or they hate Steam Deck users