Attackers replaced JDownloader installer downloads with malware_MALWAREBYTES:ADBA5FBB43CDF0C2A7E760B56A5EB285

{
    "lastseen": "2026-05-15T14:05:07",
    "description": "If you downloaded the JDownloader installer during the compromise window (May 6-7), you are advised to verify the file.\n\nJDownloader is a popular download management application, particularly favored for automated downloads from file-hosting services, video sites, and premium link generators.\n\nThe JDownloader website was confirmed to have been compromised on May 6-7, 2026. During that window, the Windows \"Download Alternative Installer\" links and the Linux shell installer were compromised. Other download options, including macOS, JAR files, Flatpak, Winget, and Snap packages remained safe.\n\nUsers that applied updates during that period were not affected. The malicious Windows installers deployed a Python-based remote access Trojan (RAT).\n\nThe developers confirmed the breach on May 7, immediately taking the website offline for investigation. After security patches were applied and server configurations hardened, the website was restored on May 8-9 with verified clean installer links. The attack vector was identified as an unpatched CMS security bug that allowed attackers to modify access control lists without authentication.\n\n## How to stay safe\n\nThe developers advised users to verify that their installers have the proper digital signatures from \"AppWork GmbH,\" which compromised versions lacked.\n\nA full system scan with a trusted anti-malware solution never hurts either.\n\nMalwarebytes blocks the domains contacted by the RAT.\n\n![Malwarebytes blocks parkspringhotel\\[.\\]com](https://www.malwarebytes.com/wp-content/uploads/sites/2/2026/05/blocked_domain.png)Malwarebytes blocks parkspringhotel[.]com\n\n* * *\n\n**We don\u2019t just report on threats\u2014we remove them**\n\nCybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.",
    "published": "2026-05-15T12:45:47",
    "modified": "2026-05-15T12:45:47",
    "type": "malwarebytes",
    "title": "Attackers replaced JDownloader installer downloads with malware",
    "source": "",
    "references": "",
    "id": "MALWAREBYTES:ADBA5FBB43CDF0C2A7E760B56A5EB285",
    "bulletinFamily": "blog",
    "cwe": null,
    "cvelist": [],
    "sourceData": "",
    "sourceHref": "",
    "cvss": {
        "score": 0,
        "severity": "NONE",
        "vector": "NONE",
        "version": "NONE"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "https://www.malwarebytes.com/blog/news/2026/05/attackers-replaced-jdownloader-installer-downloads-with-malware",
    "category_name": "News",
    "post_link": "",
    "product": "",
    "version": "",
    "vendor": "",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}