JDownloader site hacked, installers replaced with malware

JDownloader’s official website was compromised earlier this week, leading to the Windows “Download Alternative Installer” and the Linux shell installer links pointing to malicious payloads. Attackers exploited an unpatched content‑management system vulnerability to modify the download URLs without gaining server‑level access. The Windows installer now contains a Python‑based remote access trojan that pulls additional modules from two command‑and‑control servers, while the Linux installer has been altered to serve a disguised SVG file that extracts two ELF binaries, installs a SUID‑root binary named systemd‑exec, and persists by adding a script to /etc/profile.d. Users who downloaded and ran the affected installers between May 6 and May 7 are at risk of arbitrary code execution, credential theft, and full system compromise.

JDownloader, a popular download manager whose installers are signed by AppWork GmbH, has taken its site offline for investigation and released an archive of the malicious installers for analysis. The developers warned that any installer lacking the AppWork signature or signed by a different name should be avoided. They urged users who may have run the compromised installers to reinstall their operating systems, reset passwords, and verify digital signatures before downloading again. The incident underscores the importance of patching CMS platforms, monitoring download links, and validating software signatures to protect users from supply‑chain attacks.

The breach highlights how attackers can leverage seemingly minor vulnerabilities to deliver sophisticated malware. By injecting a Python RAT into the Windows installer and a SUID‑root binary into the Linux installer, the attackers gained persistent, privileged access to compromised machines. The use of two command‑and‑control servers for the Windows payload and the persistence script in /etc/profile.d for the Linux payload demonstrate a coordinated effort to maintain control over infected systems. The incident serves as a stark reminder that even widely trusted software distribution channels can become vectors for malware if security practices lapse.