JDownloader Site Breach Installs Rootkits that Kill Your Antivirus

In a May 6–7, 2026 supply‑chain compromise of the official JDownloader website, attackers replaced official installers with malicious variants that deploy a five‑component framework (PyArmor bot, PyArmor runtime DLL, r77 rootkit stager, WDAC deny‑list policy, and Python installer). The campaign uses a CMS exploit to deliver a dropper that evades automated sandboxes, installs a WDAC policy to block many AV products, hides artifacts via the r77 rootkit ($77 prefix), and employs Dead‑Drop Resolvers plus a DGA for C2 resilience; remediation notes include removing unauthorized SIPolicy.p7b and performing a full OS reinstall for complete recovery.