this post was submitted on 13 May 2026
146 points (100.0% liked)

Steam Hardware

22056 readers
849 users here now

A place to discuss and support all Steam Hardware, including Steam Deck, Steam Machine, Steam Frame, and SteamOS in general.

As Lemmy doesn't have flairs yet, you can use these prefixes to indicate what type of post you have made, eg:
[Flair] My post title

The following is a list of suggested flairs:
[Deck] - Steam Deck related.
[Controller] - Steam Controller related.
[Machine] - Steam Machine related.
[Frame] - Steam Frame related.
[Discussion] - General discussion.
[Help] - A request for help or support.
[News] - News about the deck.
[PSA] - Sharing important information.
[Game] - News / info about a game on the deck.
[Update] - An update to a previous post.
[Meta] - Discussion about this community.

If your post is only relevant to one hardware device (Deck/Machine/Frame/etc) please specify which one as part of the title or by using a device flair.

These are not enforced, but they are encouraged.

Rules:

Link to our Matrix Space

founded 4 years ago
MODERATORS
 

From the Emudeck discord:

@everyone Hey everyone, apologies for the ping but since this is deemed as critical to the security of people's devices here, I will have to. Cemu (The Wii U emulator) was recently compromised by a malicious attacker using a known developers account, this compromise took place from May 6th to May 12th, and introduces malware that is known to steal passwords, SSH keys, GitHub tokens, and likely more they are not fully aware of at this moment. We recommend anybody who is on Linux or SteamOS to go into the EmuDeck app, Manage Emulators tab, Cemu, and click Reinstall/Update, and make sure the hash of the AppImage (Located in Home/Applications, right click Cemu AppImage, go into Properties, Checksums, and Calculate the SHA256 hash) matches the non-compromised version provided by the Cemu developers, if you have used Cemu from the dates I have mentioned, and the SHA256 hash does not match what is listed, assume your system may be compromised if it was ran. If you are on Windows, MacOS, or used the Flatpak version, you are not affected by this malware. More information regarding this attack can be found here. https://rentry.org/cemu-security-psa

The specifically affected packages were:

Cemu-2.6-x86_64.AppImage

cemu-2.6-ubuntu-22.04-x64.zip

top 25 comments
sorted by: hot top controversial new old
[–] HeyThisIsntTheYMCA@lemmy.world 4 points 6 hours ago (1 children)

I haven't opened cemu in like a year. Am I good?

[–] Fubarberry@sopuli.xyz 5 points 6 hours ago (1 children)

Yes, you would have had to downloaded a recent update, and run it at least twice.

[–] HeyThisIsntTheYMCA@lemmy.world 3 points 5 hours ago

Thank you. I've been grinding ni no kuni 2 on the ps5 instead of trying to play whatever I was trying to play on cemu. It was one of the Zeldas.

[–] Fubarberry@sopuli.xyz 76 points 22 hours ago (6 children)

Also I thought this part was interesting:

Special note for Israeli users: If the malware determines that your location is Israel (it does this via locale and timezone checks) then it has a 1:6 chance that it will play a loud siren sound and run rm -rf /, essentially attempting to wipe your filesystem.

[–] SarahValentine@lemmy.blahaj.zone 70 points 22 hours ago

From the river to the C:/

[–] youcantreadthis@quokk.au 21 points 19 hours ago

That's prettyfuvking based

[–] SamueruSama@programming.dev 42 points 21 hours ago* (last edited 21 hours ago) (1 children)

It turns out the malware doesn't work because it runs subprocess.run(["rm", "-rf", "/*"])

That will never delete anything, since there is no shell to expand the glob in /* here, so rm gets a literal /* as the path to delete 😭

[–] SpaceNoodle@lemmy.world 37 points 21 hours ago (2 children)

This is why you test your code, people

[–] Katana314@lemmy.world 2 points 4 hours ago (1 children)

Which leads to the interesting question: How do the authors of infectious, destructive viruses test their code?

[–] SpaceNoodle@lemmy.world 1 points 4 hours ago

I'd set up an air-gapped test network. Could possibly set up some virtual hosts to emulate part of it, but I'd keep the whole setup isolated as a failsafe.

[–] elvith@feddit.org 4 points 19 hours ago

Whew, thankfully it didn’t work on my machine!

[–] cheat700000007@lemmy.world 12 points 22 hours ago (1 children)
[–] youcantreadthis@quokk.au 7 points 19 hours ago

I think I'm on team malware now

[–] mnemonicmonkeys@sh.itjust.works 8 points 21 hours ago (1 children)

Maybe now they'll figure out that they need to vote Netanyahu out of office for being a genocidal piece of shit

[–] youcantreadthis@quokk.au 3 points 19 hours ago

Right they need a properly omnicidal megalomanic no mere genocide

[–] tanisnikana@lemmy.world 5 points 22 hours ago (1 children)

That’s not malware.

That’s amazing.

[–] Fubarberry@sopuli.xyz 10 points 21 hours ago (2 children)

It also trys to steal passwords/keys/etc, the Russian roulette part is just extra for people in Israel.

[–] Grimy@lemmy.world 7 points 20 hours ago (1 children)

Is this considered Chaotic Good or Lawful Evil?

[–] youcantreadthis@quokk.au 4 points 19 hours ago

Definitely not evil

[–] tanisnikana@lemmy.world 1 points 20 hours ago

That’s fair. I hope Israel gets what’s coming to them.

[–] TachyonTele@piefed.social 33 points 23 hours ago

If you are on Windows, MacOS, or used the Flatpak version, you are not affected by this malware.
Flatpacker here. Thank you for including this

[–] gedfromgont@piefed.ca 11 points 20 hours ago (2 children)

The following files and directories may be created by the malware: /tmp/.transformers /usr/bin/pgmonitor.py ~/.local/bin/pgmonitor.py /etc/systemd/system/pgsql-monitor.service ~/.config/systemd/user/pgsql-monitor.service /tmp/kubectl The absence of these files does not prove that you are safe.

Wouldn't the Steamdecks immutability prevent changes to the filesystem in these folders? After rebooting at least.

[–] afaix@lemmy.world 14 points 20 hours ago (1 children)

Some of the directories are in the home (the tilda ~ means home of the current user) and home directory is not immutable

[–] gedfromgont@piefed.ca 8 points 20 hours ago

You're right, I missed the tilda.

[–] pivot_root@lemmy.world 9 points 19 hours ago

/tmp/kubectl

If someone has kubectl installed on their steam deck, they have more problems than just malware. For example: workaholism.