Google Threat Intelligence has unveiled a groundbreaking blog series dedicated to equipping cybersecurity experts with cutting-edge techniques for advanced threat hunting. The series begins with an in-depth exploration of identifying malicious .desktop files on Linux systems.
In the Linux desktop ecosystem, .desktop files are essential configuration elements that define the behavior and appearance of applications. Typically adhering to the Desktop Entry Specification, these text-based files contain various keys such as Name, Exec, Icon, and Type, all prefaced by the [Desktop Entry] header. However, Google Threat Intelligence has recently observed a surge in .desktop files that stray from the standard format, signaling a new threat vector.
Here’s a glimpse at a typical .desktop file structure:
ini
[Desktop Entry]
Name=Application Name
Comment=Short description
Exec=/path/to/executable %U
Icon=icon-name
Terminal=false
Type=Application
Categories=Utility;Application;
These files, which appear innocuous at first glance, are now being manipulated in malicious campaigns, some of which may be linked to Zscaler’s 2023 research. The malicious files contain massive volumes of junk code—often filled with the # character—to obfuscate their true intentions.
Beneath the clutter, however, the familiar .desktop structure remains intact, with the Exec key being repurposed to execute harmful commands when a user interacts with the file, such as by double-clicking.
One common technique involves using Google Drive to host decoy PDF files, which divert the victim’s attention while additional stages of malware are silently downloaded in the background.
How the Attack Unfolds
As detailed in a Google Threat Intelligence report shared within the Google community, when activated, these rogue .desktop files often call the xdg-open command to open a PDF hosted on Google Drive through the system’s default browser—typically Firefox in environments like XFCE.
This attack process unfolds as follows:
- xdg-open: Determines the desktop environment and hands the task off to the corresponding helper.
- exo-open: On XFCE systems, this forwards the request to open the URL.
- exo-helper-2: Utilizes MIME type configurations to launch Firefox and open the Google Drive link.
The behavior captured in sandbox tests highlights key indicators for threat hunters. Specifically, the use of exo-helper-2 with arguments such as –launch WebBrowser and a Google Drive URL points to potentially malicious activity.
File Structure Analysis
Advanced Threat Hunting Approaches
Google Threat Intelligence presents a range of query-driven techniques designed to uncover malicious .desktop files through both behavioral patterns and content examination:
The following table provides a detailed overview of the proposed strategies for identifying harmful .desktop files, highlighting key queries and their intended use cases.
| Hunting Approach | Query | Objective |
|---|---|---|
| Focusing on exo-helper-2 Processes | behavior_processes:”–launch WebBrowser” behavior_processes:”https://drive.google.com/” | Detects .desktop and ELF files that trigger Google Drive URLs, providing a targeted detection method for XFCE systems. |
| Expanding to All URL-Opening Processes | (behavior:”xdg-open” or behavior:”exo-open” or behavior:”exo-helper-2″ or behavior:”gio open” or behavior:”kde-open”) and behavior_processes:”https://drive.google.com/” | Broadens detection capabilities to GNOME (gio open) and KDE (kde-open) environments, encompassing a broader spectrum of malicious activities linked to Google Drive URLs. |
| Utilizing xdg-open Artifacts (1) | behavior:”/usr/bin/grep grep -i ^xfce_desktop_window” filename:”*.desktop” | Identifies .desktop files based on commands executed by xdg-open, tailored for XFCE environments as highlighted in sandbox analyses. |
| Utilizing xdg-open Artifacts (2) | behavior:”/usr/bin/grep grep -i ^xfce_desktop_window” behavior_processes:”https://drive.google.com/” | Combines detection of XFCE environments with Google Drive URL interactions to pinpoint associated malicious files. |
| Utilizing xdg-open Artifacts (3) | behavior:”/usr/bin/grep grep -i ^xfce_desktop_window” (behavior_processes:”https://drive.google.com/” or (behavior_processes:”http” behavior_processes:”.pdf”)) | Expands detection by pairing XFCE environment recognition with Google Drive or other PDF-related URLs. |
| Content-Based Detection | content:{45 78 65 63 3d 62 61 73 68 20 2d 63 20 22} content:{4e 61 6d 65 3d} content:{2e 70 64 66} content:{5b 44 65 73 6b 74 6f 70 20 45 6e 74 72 79 5d} | Targets typical strings within harmful .desktop files (e.g., Exec=bash -c “, Name=, .pdf, [Desktop Entry]) using hexadecimal string matching. |
| Generic .Desktop File Detection | content:{5b4465736b746f7020456e7472795d}@0 p:1+ | Detects .desktop files acting as malicious downloaders or loaders by analyzing the [Desktop Entry] header, identifying samples that initiate harmful processes like cryptocurrency miners. |
Google Threat Intelligence has detected a series of .desktop files uploaded in 2025, potentially tied to a campaign linked to Zscaler, though attribution has not been confirmed. Noteworthy samples include:
- Opportunity for Exercise, Re Exercise of Option for pay Fixation.desktop (SHA1: c2f0f011eabb4fae94e7a5973f1f05208e197db983a09e2f7096bcff69a794d1, April 30, 2025, India)
- Revised SOP for Webex Meeting – MOD.desktop (SHA1: 8d61ce3651eb070c8cdb76a334a16e53ad865572, April 15, 2025, India)
- Award Medal Declaration Form.desktop (SHA1: 1814730cb451b930573c6a52f047301bff0b84d1, April 8, 2025, Australia)
These files, primarily uploaded from India and Australia (possibly through proxies), highlight the international scope of the ongoing threat.
In its blog series, Google Threat Intelligence empowers security professionals with actionable, query-based methods for detecting malicious .desktop files. By integrating behavioral analysis, process monitoring, and content inspection, these strategies enable proactive detection of threats across Linux systems.
The shared queries are flexible and can be adapted for specific internal threat-hunting efforts or applied to different platforms. As the tactics behind .desktop file exploitation evolve, adopting these approaches is essential for staying ahead of increasingly sophisticated cyberattacks.
