The official Xubuntu website briefly served Windows malware to users trying to download the distro between 18-19 October. ISOs were not affected. You're reading Xubuntu Website Hijack Served Malware Downloads (Now Fixed), a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.