JDownloader Website Hijacked to Distribute Malware via CMS Exploit

Summary

JDownloader's official website was compromised via a CMS vulnerability, allowing attackers to replace legitimate Windows and Linux installers with malware-laden versions. Existing installations remain safe due to cryptographic signing, users who downloaded and executed the affected files on May 6-7 are advised to change all passwords, and enable multi-factor authentication or reinstall their operating systems.

Take Action:

If you downloaded and ran the JDownloader Windows Alternative Installer or Linux shell script between May 6 and May 7, 2026, you should assume your system is compromised. Remove the systems, or ideally reinstall your system. Standard antivirus scans cannot guarantee the removal of this malware. Affected users must change all passwords and enable multi-factor authentication (MFA) on all accounts.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines