The JDownloader download manager website was compromised between May 6–7, 2026, with attackers exploiting an unpatched CMS vulnerability to replace Windows and Linux installer download links with malicious payloads. The Windows payload deploys a heavily obfuscated Python-based remote access trojan (RAT) acting as a modular bot framework communicating with C2 servers. The Linux installer was injected with code that downloads ELF binaries, installs a SUID-root binary, and establishes persistence via systemd masquerading. In-app updates, macOS, Flatpak, Winget, Snap, and the main JAR were unaffected. Users who installed the compromised versions are advised to reinstall their OS and reset all credentials. This is part of a broader trend of supply chain attacks targeting popular software download sites.
