JDownloader site breach swapped installers with Python RAT

JDownloader’s official website was compromised between May 6 and May 7. Attackers replaced the Windows “Download Alternative Installer” and the Linux shell installer with a Python-based remote access Trojan. Other download options were not altered.

AppWork GmbH, the developer of JDownloader, confirmed the breach on May 7 and took the site offline for an investigation. The site was restored on May 8–9 after security patches were applied and server configurations were hardened. AppWork published verified, clean installer links when the site returned.

Security analysis found the malicious payload inside the swapped Windows installers and the compromised Linux shell installer. The altered installers did not carry AppWork GmbH’s digital signatures. Users who downloaded installers from the official site during May 6–7 are advised to verify the signer on any installer file and to run a full system scan with an up-to-date anti-malware product.

Malwarebytes blocks domains linked to the RAT’s command-and-control activity, including parkspringhotel[.]com.

Investigators identified the entry point as an unpatched vulnerability in the site’s content management system that allowed attackers to modify access control lists without authentication. AppWork applied fixes to the CMS and changed server settings to prevent similar unauthorized changes.

The compromise was limited in scope. The macOS installer, standalone JAR files and packaged formats distributed through Flatpak, Winget and Snap were not modified during the intrusion. Users who obtained JDownloader through those channels or who updated via the program’s built-in updater during the breach window reportedly did not receive the infected files.

JDownloader is a download manager commonly used to automate downloads from file-hosting services, video sites and premium link generators. AppWork advised anyone who obtained installers from the official site on May 6 or May 7 to confirm the installer bears the AppWork GmbH signature and to scan affected systems for malware.