JDownloader Site Compromised: Malicious Installers Distribute Python RAT Malware

Key Findings

• JDownloader's official website was compromised on May 6-7, allowing attackers to distribute malicious Windows and Linux installers

• The attack exploited an unpatched CMS vulnerability that allowed unauthorized modification of access control lists without authentication

• Only alternative installers were affected; macOS versions, core JAR files, and in-app updates remained secure due to separate infrastructure and cryptographic verification

• Users who downloaded compromised files during the breach window should perform a complete OS reinstall rather than rely on antivirus scanning

• The website was fully restored on May 9 after security patches were applied

Background

JDownloader is a widely-used open-source download management tool trusted by millions of users worldwide. The application's official website serves as the primary distribution point for new installations and updates. On May 6, the developers discovered that attackers had gained unauthorized access to modify download links on the site, replacing legitimate installers with malicious versions. Users first reported suspicious behavior on Reddit, prompting the development team to take immediate action.

The Attack Vector

The compromise stemmed from an unpatched security flaw in the website's Content Management System. This vulnerability allowed attackers to modify access control lists without authentication, granting them the ability to alter web content and change download URLs. Server logs revealed that attackers conducted a connectivity test on a low-traffic test page at 23:55 UTC on May 5, then moved to the live site at 00:01 UTC on May 6.

The attackers specifically targeted two installation methods: the Windows Alternative Installer and the Linux shell script. The Linux version was altered to include malicious shell code, while the Windows executables lacked proper digital signatures. Legitimate JDownloader installers are always digitally signed by AppWork GmbH. The compromised files either had no signatures or displayed unauthorized publisher names like Zipline LLC, The Water Team, and Peace Team. Users attempting to execute these files encountered warnings from Microsoft Defender and SmartScreen.

Scope and Impact Assessment

The compromise was limited to the alternative download links on the main website. Critically, several distribution channels remained unaffected because they use separate infrastructure and cryptographic protections. Existing JDownloader installations were not compromised since the application's internal update system uses RSA-signed verification on completely separate servers. Third-party package managers including Flatpak, Winget, and Snap were also unaffected. The core JDownloader.jar file and macOS installers remained untouched with valid signatures intact.

Remediation and Recovery

The website was fully restored on May 9 after the development team applied security patches and hardened the server configuration. However, the developers issued a serious warning for anyone who executed the compromised installers between May 6 and 7. Standard antivirus scanning may not be sufficient to remove all persistence mechanisms installed by the malware. For maximum security, users are recommended to perform a complete operating system reinstall to ensure their environments are fully clean.

Sources

• https://hackread.com/hackers-hijack-jdownloader-site-malware-installers/

• https://piunikaweb.com/2026/05/08/jdownloader-website-hacked-malware/

• https://www.reddit.com/r/SecOpsDaily/comments/1t8j11v/jdownloader_site_hacked_to_replace_installers/

• https://www.reddit.com/r/cybersecurity/comments/1t8g9hf/jdownloader_site_hacked_to_replace_installers/