The Raspberry Pi Foundation revealed on Twitter that on Dec. 23, it had been offered — seemingly seriously — money to include a malware .exe file as part of the system it provides users. The offer was from an obviously non-English speaker named Linda, whose suspicious request was riddled with poor grammar.

About Raspberry Pi

Raspberry Pi was developed as a simple computer that offers multiple basic functions. It can be used as part of more complex projects because of its ability to be programmed. The device currently retails for under $35 and has already seen significant adoption, having sold over 4 million units worldwide.

The nefarious email — which was addressed to Liz Upton, the foundation’s director of communications — said that the .exe file would create a desktop shortcut that allowed users to automatically log in to a website once they clicked on it. Additionally, Upton was asked to provide a “favorable and kind quotation about PPI (price per install).”

Who Wants a Piece of the Pi?

What is really surprising about all this to Pi users is that the Pi usually runs the Linux OS, notably the ARM GNU/Linux distributions and the Snappy Ubuntu Core. The newest and most powerful version of the device is capable of using Windows 10, but Linux is the primary system, SecurityWeek reported.

The .exe designation for the malware file suggested means that it requires Windows to be run. Such a file wouldn’t execute under Linux, so why Linda would even consider Raspberry Pi as a way to effectively distribute the file is puzzling and seems rather unsophisticated.

The solicitor may have been thinking that the more powerful Pi devices would end up being used in the future with Windows, hence why the file’s shortcut would be included as well.

Foiling the Malware Plan

The Raspberry Pi Foundation did not reveal the name of the organization that approached them but did call them “evildoers.” SecurityWeek noted that some of the people commenting on the foundation’s tweet suggested that the website the email was referring to might be jogotempo.com. One user said the style of the email was very similar to other attempts received from the site in the past.

In any case, users can rest assured the foundation will not be accepting the money nor distributing the file.