The official website of JDownloader, a download manager widely used around the world, was compromised by hackers between May 6 and 7, 2026. Durante During this period, attackers replaced legitimate download links with malicious installers, affecting Windows and Linux users who downloaded the software directly from the official source.
Criminals did not break into JDownloader’s main server. Exploram an unpatched security flaw in the website’s content management system, allowing access permissions to be changed without authentication. With this, they were able to edit the download links and point them to malicious files hosted on external servers. Developer AppWork GmbH confirmed that the attacker only accessed the management panel, not the server itself, and that users’ personal data remained intact.
Quais installers have been compromised
Apenas specific versions have changed. No Windows, only “Download Alternative Installer” has been replaced with malicious code. No Linux, the shell script installer, was also compromised during the critical period.
More on this story: Cyber attack in France exposes tax information of 678 thousand taxpayers
- Instaladores on macOS
- Pacotes Flatpak, Winget or Snap
- Arquivo main JDownloader.jar
- Atualizações within the program (use separate infrastructure with digital signature verification)
Users who downloaded through these channels were not at risk of infection, as they have additional integrity checking mechanisms.
https://twitter.com/Pirat_Nation/status/2052479496222081403?ref_src=twsrc%5Etfw
The behavior of malware in Windows
No Windows, the fake installer, worked as a loader, serving as a gateway for a remote access trojan written in Python. Esse RAT gives the attacker remote control over the compromised computer, allowing them to execute commands remotely. The malware connected to command and control servers to receive instructions from the criminal. Security Pesquisador Thomas Klemenc identified two servers used for this communication and published indicators of compromise to assist security teams in detecting infected machines. The final payload had the ability to execute arbitrary code on the system, making a simple uninstall insufficient to remove the infection completely.
Funcionamento on Linux
The compromised shell script downloaded a file disguised as an SVG image from an external server. Dentro of this file there were two hidden binaries. One of them was installed with root permissions, the highest level of access on Linux systems. The malware created persistence mechanisms and masked itself as a legitimate operating system process to make detection difficult. The payload was heavily obfuscated with Pyarmor, a tool that complicates technical analysis of malicious code.
Learn more: Cyber attack on Apple’s Indian supplier exposes iPhone 18 Pro details before official launch
Como a user of Reddit identified the attack
The issue was discovered by an Reddit user named PrinceOfNightSky while setting up a new computer. Ele downloaded the latest version directly from the official website. Microsoft Defender flagged the installer as malicious. The file showed the names “Zipline LLC” and “The Water Team” as developers, companies with no relation to AppWork. The user reported the situation, and the developers confirmed the compromise a few hours later. The site was deactivated at 2:24 pm on May 7 to investigate and contain the incident.
Processo site recovery and return
Developers worked through the early hours of May 8 fixing the vulnerability, restoring legitimate links from backups, and hardening server security settings. The site remained completely offline until all integrity checks were completed. Entre On May 8th and 9th, JDownloader started working normally again, with links checked and the security flaw fixed. The developers published a notification on the homepage and official forum explaining the incident and providing guidance to potentially affected users. Fixes included implementing more robust authentication for the management panel and additional verification before any changes to download links.
Como check if you downloaded a compromised file
Quem downloaded an installer between May 6th and 7th can verify the legitimacy of the file. No Windows, just right click on the file, open Propriedades and access the Assinaturas Digitais tab. Legitimate Arquivos display the name “AppWork GmbH” in the subscriber section. Ausência signature or presence of other name indicates malicious file that should not be executed. No Linux, verifying the original source of the file and comparing cryptographic hash with values published by the developer provides additional protection against distribution of compromised versions.
What to do if you installed the file
Developers recommend completely reinstalling the operating system. Como malware may have executed arbitrary code on the machine, simple uninstallation does not guarantee full removal of the infection. Também is strongly recommended to change all passwords used on the affected device, as credentials may have been captured by the malware during the period of compromise. Usuários should consider changing passwords on bank accounts, email and important services from another secure device. Monitoramento of bank account and suspicious credit activities in the following months is also advisable.
Contexto from similar attacks
Incidentes of this type have become progressively frequent. In April 2026, the CPUID website suffered a similar compromise, with links to CPU-Z and HWMonitor replaced with malicious executables. Semanas before, the Tools DAEMON website was the target of a comparable attack. Esses supply chain attacks exploit user trust in official sources for mass distribution of malware, posing increasing risk in the digital security ecosystem.