JDownloader hacked: the attack nobody saw coming

Little in information security is as brutal as discovering that the place where you downloaded a trusted program served, for 48 hours, a trojan horse instead of the original executable. That's exactly what happened to JDownloader between 6 and 7 May. The official site — not a mirror, not a pirated copy, the official domain — handed Windows and Linux users an installer swapped for a Python RAT capable of arbitrary remote execution. And anyone who clicked "download" in that window now has a machine compromised right down to the operating system.

What exactly was attacked

JDownloader is a veteran download manager, distributed by Germany's AppWork GmbH, with an installed base in the millions. It has versions for Windows, Linux, macOS and the traditional cross-platform .jar. The attack compromised only two installation paths:

• The "Alternative Installer" for Windows link (the .exe many people prefer to the standard installer)
• The shell installer for Linux (the script that automates installation on distros)

Everything else — the Snap, Flatpak and Winget packages, the macOS version, the main JAR and the automatic updates inside JDownloader itself — came through unscathed. Why that matters will become clear in the defence section.

How the site was breached

The attackers exploited an unpatched vulnerability in the content management system (CMS) used by the site. The flaw allowed access control lists and published content to be modified without authentication — no login, no key, nothing. With that access, they swapped the destinations of the two download links to point at files hosted on servers they controlled.

It's a classic of the supply chain attack genre: you don't break into the end user, you break into the software vendor that user trusts. The user follows every best practice — download from the official site, check the domain, avoid mirrors — and is compromised anyway, because the original source was corrupted.

What the malware does

The payload delivered on Windows was a modular RAT (Remote Access Trojan) written in Python, heavily obfuscated. Modular means the attacker can send new commands later — they aren't limited to the code delivered at the moment of infection. Obfuscated means the antivirus has more work to do to identify the signature.

In practice, the RAT allows arbitrary code execution issued from command and control (C2) servers. That means: theft of passwords saved in the browser, screen capture, keylogging, file exfiltration, installation of further payloads. The Linux equivalent uses ELF binaries with root-level persistence mechanisms — worse still, because the attacker starts out with elevated privileges.

What to do if you downloaded in that window

AppWork was blunt in its recommendation for anyone who ran the compromised installer: reinstall the operating system. That isn't overkill. A RAT with root-level persistence on Linux or arbitrary execution on Windows may have created backdoors in places a surface-level antivirus will never clean.

The practical checklist:

1. Defensive backup of the files that matter, to external media, before touching anything else. Treat them as possibly contaminated until you've scanned them on another machine.
2. Format and reinstall the operating system from scratch.
3. Change every password for any account you used on the infected machine — starting with email, banking, password manager and any SMS-based 2FA (which may have been captured).
4. Revoke active sessions on Google, Microsoft, GitHub, Discord, any service with a persistent login.
5. If you used a credit card on the machine, consider telling the bank and generating a new virtual card.

To confirm that a JDownloader installer is legitimate from here on, verify the "AppWork GmbH" digital signature before running it. On Windows: right-click the file → Properties → Digital Signatures. If the name doesn't match, the file is fake, full stop.

The bigger lesson: supply chain is the vector of the decade

This isn't an isolated case. In 2024, the XZ Utils backdoor came within a hair of reaching production on Linux servers worldwide, disguised as a code contribution. In 2020, SolarWinds Orion shipped a signed, legitimate update that delivered malware to 18,000 customers — including US government agencies. The pattern is the same: the attacker understands that end users have learned to distrust an email with a .zip attachment, but still trust the "Download" link on the vendor's own site blindly.

For an ordinary user, three habits close most of the gap:

• Prefer audited package managers — Winget on Windows, apt/dnf on the Linux distro you already use, Snap or Flatpak where available. It's no accident that those channels came through the JDownloader attack untouched: the package goes through signature verification before it reaches your machine.
• Check the digital signature before running installers downloaded manually.
• 2FA with an app, not SMS. If the RAT captures your password, you still have a barrier.

Convenience usually charges a price in security. But in the specific case of package managers, that price is negative: the convenience increases security, because it takes out of your hands the decision to trust a loose file on the internet. Anyone still putting off adopting Winget on Windows is losing on both counts.

If you enjoyed this kind of technical coverage of recent attacks, we've been through the classics of the genre here, such as the ILOVEYOU virus and the Sasser worm. To shore up the network side of the defence, it's also worth a look at NextDNS. Did you download JDownloader between 6 and 7 May? Tell us in the comments how you found out — and whether you've already reinstalled.