Downloaded Cemu for Linux recently? You may have malware

The Linux builds of Cemu 2.6 (AppImage and Ubuntu 22.04 ZIP) on GitHub were compromised between May 6–12, 2026, after a collaborator's GitHub token was stolen via a malicious Python package. The attacker used the token to replace the Linux binaries with malware-laden versions. The Flatpak and Windows/macOS builds were not affected. The malware is believed to harvest credentials, cloud tokens, SSH keys, and configs, and will attempt to wipe the entire filesystem for users in Israel. Users who downloaded and ran the affected builds are advised to reinstall their OS and reset all critical credentials immediately.