Trust Hijacked: Official JDownloader Website Breached to Distribute Malicious Installers

**JDownloader website compromise:** Attackers exploited an unpatched backend vulnerability to modify ACLs and replace alternative Windows and Linux installers on the official JDownloader download page between May 6–7, delivering malicious installers to users; macOS installers, the core JDownloader.jar, package manager distributions (Flatpak, Winget, Snap), and in-app auto-updates were reported unaffected, but users who downloaded the affected installers are advised to treat their machines as compromised.