JDownloader Downloader Hacked to Infect Users With New Python RAT

In early May 2026 attackers exploited an unpatched CMS vulnerability on jdownloader.org to swap legitimate download links with malicious unsigned installers that bundled the real installer plus an XOR- and PyArmor-protected Python remote access trojan, enabling persistent, encrypted C2 communications and arbitrary remote code execution for victims who downloaded the affected files between May 6–7.