JDownloader Website Compromised to Distribute Malicious Windows and Linux Installers

Between May 6–7, 2026 attackers exploited an unpatched CMS vulnerability on the official JDownloader website to replace Windows (alternative) and Linux installers with trojanized versions containing a Python-based Remote Access Trojan (RAT); the site was taken offline, cleaned and patched, users who downloaded installers during the window were advised to verify hashes, re-download, and scan systems, and developers confirmed internal updater users were not affected.