JDownloader's Official Site Distributes Malware to Windows and Linux Users in Major Supply Chain Attack

Key Findings

• JDownloader's official website was compromised between May 6-7, 2026, serving malicious installers to Windows and Linux users instead of legitimate software

• Attackers deployed a Python-based remote access trojan (RAT) that gave them remote control over infected systems, with an 8-minute execution delay

• The breach was limited to the Windows "Alternative Installer" and Linux shell installer; macOS, in-app updates, and package managers remained unaffected

• Attackers exploited an unpatched content management system vulnerability to redirect download links, never gaining full server or operating system access

• Malicious installers were signed by fake publishers like "Zipline LLC" and "The Water Team" instead of the legitimate AppWork GmbH

• The compromise was discovered by a Reddit user who noticed Windows SmartScreen flagging the downloads as malicious

Background

JDownloader is a free, open-source download manager used by millions worldwide to automate and simplify file downloads from websites, file hosting services, and video platforms. Its popularity across Windows, Linux, and macOS platforms made the supply chain compromise particularly serious, as users downloading the latest version from the official site had no reason to suspect they were getting anything but legitimate software.

Attack Timeline and Discovery

The attack unfolded rapidly with careful precision. Attackers tested their method on a dummy site on May 5, 2026, at 23:55 UTC, then executed the real compromise just minutes later at 00:01 UTC on May 6. For over a day, users downloading from the official JDownloader website received malware instead of the genuine application.

A Reddit user known as PrinceOfNightSky first publicly flagged the issue on May 7 after Windows Defender flagged the downloaded installers. The user had an older installer on a USB drive from a previous PC setup and immediately noticed the difference in developer signatures and publisher names. This comparison made the compromise obvious - the USB drive installer correctly showed AppWork GmbH as the publisher, while the freshly downloaded file showed unfamiliar names like "Zipline LLC" and "The Water Team."

JDownloader developers confirmed the breach within hours and took the website offline for investigation and remediation.

The Vulnerability and Attack Method

The attackers exploited an unpatched vulnerability in JDownloader's content management system, gaining the ability to modify download pages and alter the links users would click. However, this access remained limited - they never compromised the underlying servers or operating system infrastructure.

The attackers' strategy was precise targeting rather than broad damage. They modified only the alternative download page links for Windows and the Linux shell installer link. All other distribution methods remained untouched and secure throughout the incident.

Malware Details

The malicious Windows installer deployed a Python-based remote access trojan (RAT) that would give attackers complete remote control over infected systems. Analysis by ANY.RUN revealed a sophisticated execution chain with an 8-minute delay built in before the malicious payload activated, likely designed to evade initial detection.

Two stages of malware were identified during analysis. The initial delivered installer had the hash 5a6636ce490789d7f26aaa86e50bd65c7330f8e6a7c32418740c1d009fb12ef3, with the stage 2 payload hashing to 77a60b5c443f011dc67ace877f5b2ad7773501f3d82481db7f4a5238cf895f80. The payload itself was encrypted using PyArmor to obfuscate the malicious code.

Scope and Unaffected Systems

While dangerous, the breach's impact was contained to specific download channels. The macOS installers were never compromised and maintained valid digital signatures throughout. Users downloading through alternative package managers like Flatpak, Winget, and Snap received legitimate software, as did those using in-app update mechanisms.

The core JDownloader.jar file also remained clean and uncompromised during the incident window.

Detection and Verification

Windows SmartScreen provided the first layer of defense against the compromise. Because the malicious installers lacked proper digital signatures, SmartScreen blocked or warned against their execution, alerting users that something was wrong.

JDownloader developers instructed users to verify authenticity by checking the Digital Signatures tab in file properties. Legitimate installers carry the signature "AppWork GmbH." Any unsigned files or those signed by different publishers should be rejected.

Remediation and Site Recovery

JDownloader developers removed the malicious download links and corrected them back to legitimate external hosting. The website remained fully offline while the team conducted thorough analysis, remediation, and verification of all installer sources.

The site came back online during the night of May 8-9, 2026 (UTC), after confirming all checks were complete. Normal public service resumed with verified clean installer links, and the underlying security issue was patched to prevent recurrence.

Sources

• https://securityaffairs.com/191920/malware/official-jdownloader-site-served-malware-to-windows-and-linux-users.html

• https://www.cyberkendra.com/2026/05/jdownloader-website-hacked-malicious.html