Attackers redirected selected download links on JDownloader’s official website to malicious third-party files during May 6–7, 2026 (UTC), the software’s developers said. The affected paths were the Windows “Download Alternative Installer” links and the Linux shell installer link.
The team identified users who downloaded files through those links during the affected period and executed them as potentially at risk. The investigation window does not establish that every download during those two days was malicious.
The developers said they took the website offline on May 7 and restored service on the night of May 8–9 (UTC), after correcting the links, fixing the security issue and completing further checks.
JDownloader is a free download manager that automates downloads from file-hosting services, video sites and premium link generators. It runs on Windows, Linux and macOS.
Scope of the compromise
The developers said attackers changed pages and links through the website’s content management system. Their investigation found no access to the host filesystem or broader operating-system-level control of the server.
The team said its genuine installer packages were unchanged. The altered website links instead directed visitors to unrelated malicious files hosted elsewhere.
The developers identified in-app updates, macOS downloads, Flatpak, Winget, Snap and the main JDownloader JAR package as unaffected. They said the application’s built-in updater operates independently of the manipulated website links.
The team said its own alternative Windows installers should carry an AppWork GmbH digital signature. Its incident guidance identified missing signatures or unexpected publishers as warning signs and advised against bypassing Microsoft Defender or SmartScreen warnings.
Reported malware behavior
Security researcher Thomas Klemenc described the malicious Windows executables he analyzed as loaders for a heavily obfuscated Python-based remote access trojan. He said the Python payload operated as a modular bot framework capable of executing Python code delivered by command-and-control servers.
The JDownloader team said analysis of the malicious payloads was outside its scope and made copies available for others to examine. Its assessment of the website compromise therefore did not provide a complete account of the substituted files’ capabilities.
In its own analysis of a malicious Linux shell installer, BleepingComputer reported that inserted code downloaded an archive disguised as an SVG file and extracted two Linux binaries. It said the script installed a binary named systemd-exec with SUID-root permissions under /usr/bin/ and created /etc/profile.d/systemd.sh for persistence.
That analysis described the main Linux payload, named pkg, as heavily obfuscated with PyArmor and said its functionality remained unclear.
Developer response and guidance
JDownloader’s team recommended a clean operating system reinstall for anyone unable to rule out having downloaded and executed a malicious installer. It said antivirus scans could reduce risk but could not guarantee removal of every persistence mechanism.
The developers also advised avoiding sensitive logins on a potentially compromised machine and changing important account passwords from another device. They distinguished running a malicious installer from visiting the website or downloading a file without executing it.
The incident followed Kaspersky’s disclosure earlier in May of a separate attack involving DAEMON Tools installers distributed through that software’s official website. Kaspersky said those installers contained a backdoor.
