JDownloader website compromised to serve malicious Windows and Linux installers

The official JDownloader website was compromised in early May 2026, causing some users to receive malicious Windows and Linux installers instead of the legitimate download manager.

The incident affected people who downloaded installers from jdownloader.org between May 6 and May 7, 2026 UTC using the Windows “Download Alternative Installer” links or the affected Linux shell installer link. Users who updated through JDownloader’s built-in updater were not affected.

JDownloader’s developers said the attackers changed website download links through the site’s content management system. The genuine installer files were not modified, and the attackers did not gain control of the server’s underlying file system or operating system.

What happened to the JDownloader website?

Attackers changed selected download links on the official JDownloader website so they pointed to malicious third-party files. The issue started shortly after midnight UTC on May 6, following a test on a low-traffic page late on May 5.

The main risk window continued through May 7. JDownloader said it was alerted to the issue through Reddit at 17:06 UTC on May 7, confirmed the problem, and shut the website down at 17:24 UTC.

The website stayed offline while the team removed the malicious link targets, restored the legitimate links, patched the security issue, and hardened its configuration. JDownloader said the website returned between the night of May 8 and May 9 with verified clean installer links.

Detail	Confirmed information
Incident type	Website download-link compromise
Main risk window	May 6 to May 7, 2026 UTC
Affected Windows download	“Download Alternative Installer” links
Affected Linux download	Linux shell installer link from the website
Unaffected update path	JDownloader’s built-in updater
Reported Windows payload	Python-based remote access trojan

Which JDownloader downloads were affected?

The compromise did not affect every JDownloader download. According to the developers, only specific website links were changed.

On Windows, the affected path was the “Download Alternative Installer” option. On Linux, the affected path was the shell-based installer link from the website.

Other download and update channels were not tied to the manipulated links. JDownloader said in-app updates remained safe because they use RSA signatures and cryptographic verification.

• The built-in JDownloader updater was not affected.
• Other installer options on jdownloader.org were not affected, according to the site’s incident review.
• Winget, Flatpak, Snap, and Docker images were verified as not connected to the manipulated links.
• Malwarebytes reported that macOS, JAR files, Flatpak, Winget, and Snap packages remained safe.

What malware was delivered?

Security researchers reported that the malicious Windows installers deployed a Python-based remote access trojan. This type of malware can give attackers remote control over a compromised system.

Researchers also reported suspicious publisher names on some downloaded files, including “Zipline LLC” and “The Water Team.” Legitimate JDownloader installers should show AppWork GmbH as the publisher.

JDownloader published known SHA256 hashes and file sizes for several malicious substitute files observed during the incident. Users who still have an installer from that period should compare the file against those indicators before taking any further action.

How users can check if they are at risk

The highest-risk group includes users who downloaded and executed the affected Windows or Linux installers from the official website during the May 6 to May 7 UTC window.

Downloading the file without running it creates a different risk level. JDownloader says users who never started the file should delete it and download a fresh installer from the official site.

For Windows users, the quickest check is the digital signature. A genuine installer should show AppWork GmbH. If the installer has an unknown publisher, a missing signature, or triggers SmartScreen or Microsoft Defender warnings, users should not run it.

1. Check whether the file came from the Windows “Download Alternative Installer” link or Linux shell installer link.
2. Confirm whether it was downloaded between May 6 and May 7, 2026 UTC.
3. Do not run the file if it has not already been executed.
4. Check the Windows digital signature for AppWork GmbH.
5. Compare the file hash with the malicious indicators published by JDownloader.
6. Delete suspicious installers and download a fresh copy from the official site.

What to do if the installer was executed

JDownloader recommends a clean operating system reinstall if users cannot rule out that they downloaded and executed a malicious installer. A full antivirus scan can help, but it may not remove every persistence mechanism after a remote access trojan runs.

Users should avoid sensitive logins on a potentially infected machine until they consider the system clean. Passwords for important accounts should be changed from another trusted device.

Anyone who ran a suspicious installer should also check startup entries, unknown programs, unusual network activity, and recent account alerts. Businesses should review endpoint logs and isolate affected machines before restoring them to normal use.

• Disconnect the device from sensitive accounts and services.
• Change important passwords from a clean device.
• Run a full scan with updated security software.
• Review unknown startup items and installed programs.
• Consider a full wipe and reinstall if the malicious installer ran.
• Restore only trusted personal files after the system is clean.

Why this supply chain attack matters

The JDownloader incident shows why attackers keep targeting trusted download channels. Many users treat official websites as safe by default, so a compromised download link can reach victims more easily than a suspicious email attachment.

This attack also followed other recent cases where popular software websites were abused to deliver malicious installers. BleepingComputer noted similar incidents involving CPUID and DAEMON Tools download links.

For developers, the lesson is clear. Website CMS security, access controls, monitoring, and download integrity checks matter as much as application code security. For users, the safest habit is to check signatures and never bypass security warnings, even when downloading from a familiar website.

FAQ