Ubuntu’s Official X Account Hijacked to Promote Fake “Numbat” AI Crypto Scam

Ubuntu, one of the world’s most widely used Linux distributions, became the latest high-profile victim of a social media account compromise on May 7, 2026, when unknown attackers used the official @ubuntu X account to promote a fraudulent cryptocurrency scheme masquerading as a legitimate AI product launch.

The incident adds an alarming new dimension to an already turbulent period for Canonical, Ubuntu’s parent company, which had only just weathered a sustained five-day distributed denial-of-service (DDoS) attack on its web infrastructure the week prior.

The Attack: A Textbook Impersonation Campaign

The fraudulent campaign surfaced through a thread posted from the verified @ubuntu account, announcing “Numbat” as Ubuntu’s newest AI agent — described as being built on the Solana blockchain. The posts were crafted with considerable attention to plausibility: they referenced Ubuntu’s real and publicly documented interest in artificial intelligence, and even included a note claiming that comments had been disabled “due to suspicious links and impersonation attempts” — a darkly ironic touch, given that the thread itself was the impersonation.

Users who clicked through were directed to ai-ubuntu.com, a site that bore a striking resemblance to official Canonical web properties. Security researchers who analysed the domain noted that it had wholesale lifted real Ubuntu AI documentation — including genuine references to Charmed Kubeflow, Canonical’s partnership with NVIDIA, and MLOps workflows — and wrapped them around a fake cryptocurrency airdrop scheme.

The phishing site prompted visitors to connect their cryptocurrency wallets or submit personal information in order to claim token rewards. Once a user authorised the wallet connection, the attackers gained access to the linked account and could drain its assets. Authentic tool logos — including TensorFlow, PyTorch, Jupyter, and Kafka — were embedded throughout the page to further reduce suspicion.

The Phishing Infrastructure

A WHOIS lookup performed by Cyber Kendra revealed that the fraudulent domain ai-ubuntu.com was registered just one day before the attack, on May 6, 2026, through the Hong Kong-based registrar NICENIC INTERNATIONAL GROUP CO., LIMITED. Security researchers cautioned that the registrar’s geographic location does not necessarily indicate the attackers’ origin.

The domain registration timing is consistent with a premeditated, coordinated attack — the infrastructure was in place before the account was compromised, suggesting the operator planned the campaign in advance and moved quickly once access to the @ubuntu account was secured.

Timeline of Events

• May 1 DDoS attack begins on Canonical’s web infrastructure; pro-Iran hacktivist group “313 Team” claims responsibility.
• May 6 Fraudulent domain ai-ubuntu.com registered through NICENIC INTERNATIONAL.
• May 7 Attackers post fake “Numbat” AI agent announcement thread from @ubuntu on X, linking to the phishing site.
• May 7 Security researchers flag the fraudulent campaign; posts are subsequently deleted from the @ubuntu account.
• Ongoing Canonical has issued no formal statement on the account compromise. Attacker identity remains unconfirmed.

How the Account Was Compromised

The precise method by which attackers gained control of the @ubuntu account has not been confirmed. Analysts have suggested two plausible vectors: a direct compromise of the account credentials, or a breach of a third-party social media management tool used by Canonical’s communications team to schedule and publish posts. The latter scenario is increasingly common and has been the attack vector in several high-profile account compromises affecting technology and open-source organisations.

Separately, the pro-Iran hacktivist group known as the “313 Team” — which claimed responsibility for the preceding DDoS attacks against Canonical’s infrastructure — has not explicitly claimed credit for the X account compromise. The group announced an end to its DDoS campaign but made no statement regarding the fraudulent tweets. Whether the two incidents are connected remains an open question.

Response and Current Status

The fraudulent posts were deleted from the @ubuntu account after security researchers surfaced the campaign publicly. However, as of the time of writing, Canonical has not issued any formal statement acknowledging the compromise, explaining how it occurred, or advising affected users on remediation steps.

The Ubuntu Community Hub briefly hosted a discussion thread titled “Ubuntu X account hacked,” which was subsequently deleted by its author — leaving the community without an official channel for updates on the incident.

Context: A Difficult Week for Canonical

The account compromise comes hard on the heels of a sustained DDoS offensive that began on May 1, 2026, and disrupted more than a dozen Canonical services — including Ubuntu’s security API endpoints for CVE data and security advisories, services relied upon by system administrators and patch-management pipelines worldwide. The 313 Team, presenting itself under an Islamist hacktivist banner, claimed to be using a commercial DDoS-for-hire service capable of generating traffic in excess of 3.5 Tbps.

Together, the two incidents represent an unusually concentrated period of adversarial pressure against one of the open-source ecosystem’s most critical infrastructure providers. Security analysts will be watching closely to see whether Canonical issues a comprehensive post-incident report and what hardening measures the organisation implements in response.

This article will be updated as further information becomes available. Canonical has been contacted for comment.