JDownloader Website Compromised to Distribute Malware-Laced Installers
Summary
JDownloader confirmed its website was compromised on May 6–7, 2026, and altered Windows and Linux installer links. The Windows payload installed a Python RAT; affected users were advised to reinstall their systems and reset passwords.
Key points
- Attackers exploited an unpatched CMS vulnerability to alter website content and download links; developers said they did not access the underlying server filesystem.
- The affected links were the alternative Windows installers and Linux shell installer. In-app updates, macOS downloads, Flatpak, Winget, Snap, and the main JDownloader JAR were unaffected.
- The Windows payload acted as a loader for an obfuscated Python RAT that could execute code delivered from command-and-control servers.
- The modified Linux installer downloaded additional binaries, installed one as a SUID-root binary, created a persistence script, and launched malware as root.
- Only users who downloaded and executed affected installers during the compromise window were considered at risk; developers advised reinstalling affected systems and resetting passwords.
Article Details
- Victim Organization
- AppWork GmbH
- Incident Type
- Compromise of the JDownloader website to replace alternative Windows and Linux installer links with malicious installers; the Windows installer deployed a Python-based RAT.
- Incident Date
- 2026-05-06
- Data Types Exposed
- Credentials (potentially compromised; not confirmed)
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- The website was taken offline for investigation. Users who downloaded and executed affected installers could have had arbitrary code run on their devices; developers advised reinstalling the operating system and resetting passwords.
- Ransom Or Extortion
- Unknown; no ransom or extortion activity is reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | checkinnhotels[.]com | Domain used by the modified Linux installer to download an archive disguised as an SVG file containing malicious binaries. |
| URL | hxxps[:]//auraguest[.]lk/m/douV2quu.php | URL identified by researcher Thomas Klemenc as a command-and-control server used by the malware. |
| URL | hxxps[:]//parkspringshotel[.]com/m/Lu6aeloo.php | URL identified by researcher Thomas Klemenc as a command-and-control server used by the malware. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe Windows RAT and Linux payload were described as heavily obfuscated.T1036.005 · Match Legitimate Resource Name or LocationThe Linux malware was launched while masquerading as /usr/libexec/upowerd.T1059.006 · PythonThe Windows payload deployed a Python-based RAT that could execute Python code delivered from C2 servers.T1105 · Ingress Tool TransferThe modified Linux installer downloaded an archive containing ELF binaries.T1195.002 · Compromise Software Supply ChainAttackers altered official software download links to distribute malicious installers, compromising the software supply chain.T1546.004 · Unix Shell Configuration ModificationThe Linux installer created a persistence script in /etc/profile.d/systemd.sh.T1548.001 · Setuid and SetgidThe Linux installer installed systemd-exec as a SUID-root binary.
People
Vendors
Products
JDownloaderThe official JDownloader website was compromised to serve malicious Windows and Linux installers, and the Windows payload installed a Python-based remote access trojan.Microsoft Defender Antimalware PlatformThe compromise was first reported on Reddit by a user named “PrinceOfNightSky,” who noticed that downloaded installers were being flagged by Microsoft Defender.