Official JDownloader site served malware to Windows and Linux users between May 6 and May 7

JDownloader’s official website was compromised in a supply chain style attack between 6 May and 7 May 2026, with attackers replacing legitimate Windows and Linux installers to deliver malicious files. The Windows installer reportedly carried a Python-based remote access trojan, giving attackers control over infected machines, while the Linux shell installer was also affected.

Attackers manipulated download links on the site via the content management system, altering targets but not gaining full server or operating system access. The incident specifically affected the Windows “Alternative Installer” links and the Linux shell installer, with other downloads and packages remaining safe. The breach was spotted after Microsoft Defender flagged the installers as malicious, and JDownloader developers quickly shut the site down to investigate.

They later stated that the content changes were contained to the download links and that the genuine installers remained hosted externally, with the site restored after verification. Researchers and observers noted an eight-minute delay before the malicious payload activated, according to analysis.