JDownloader website redirected Windows and Linux downloads to malware
Selected JDownloader website downloads spread malware on 6–7 May. Clean links are restored. If you ran an affected installer, arrange a clean operating-system reinstall and change important passwords from another device.
Delete any suspect installer you never ran. If you may have run one, ask a trusted technician to cleanly reinstall your operating system; avoid sensitive logins meanwhile and change important passwords from another device.
What’s happening
Attackers changed selected download links on JDownloader’s official website during 6–7 May 2026, sending Windows and Linux users to malicious files. The genuine JDownloader installer packages were not modified. Windows downloads delivered a Python remote-access trojan capable of running attacker-supplied code. BleepingComputer found that the Linux installer added persistent malicious components, although the main payload’s full capabilities were unclear. JDownloader fixed the website security issue and restored clean downloads overnight on 8–9 May. Built-in updates and other installer options were unaffected. Restoring the website did not remove malware already installed on users’ computers. As of 3 November, the reviewed sources disclose no affected-user count or later incident outcome.
- What
- Poisoned software
- Affects
- JDownloader website downloads for Windows and Linux
- Affected
- Windows: website “Download Alternative Installer” downloads obtained on 6–7 May 2026 UTC
Linux: website shell installer downloads obtained on 6–7 May 2026 UTC - Fixed in
- No fix yet
- Since
- 5 May 2026
- Closed
- 15 May 2026
Timeline
- Update
Malwarebytes reported that its protection blocked domains contacted by the Windows trojan.
- Made public
BleepingComputer reported a Python remote-access trojan in the Windows downloads. Its Linux analysis found persistent malicious components; the main payload’s full capabilities remained unclear.
- All clearFixed
The website returned overnight on 8–9 May UTC with verified clean links, following remediation and security checks. This restored downloads but did not clean infected computers.
- Update
JDownloader shut down the website after receiving a Reddit alert at 17:06 UTC.
- Update
Around 00:01 UTC, attackers redirected the alternative Windows installer links and Linux shell installer link to malicious files.
- Update
Around 23:55 UTC, attackers tested changes on a low-traffic website page.
Sources
- Website installer incident — May 2026JDownloader · 8 May 2026
- JDownloader site hacked to replace installers with Python RAT malwareBleepingComputer · 9 May 2026
- JDownloader distributed malware downloadsheise online · 11 May 2026
- Attackers replaced JDownloader installer downloads with malwareMalwarebytes · 15 May 2026