In early May 2026, attackers compromised the official JDownloader website by manipulating specific installer download links through the content management system. Between May 6-7, 2026 (UTC), users who downloaded Windows installers via "Download Alternative Installer" links or the Linux shell installer were redirected to malicious third-party files instead of genuine installers. The attackers gained CMS-level access only, not server or filesystem control. The incident was detected on May 7 via Reddit alerts, and the server was immediately taken offline. Malicious links were removed, legitimate links restored, and security hardened before the site resumed normal operations on May 8-9. In-app updates and other download paths remained unaffected. Users who executed downloaded installers during the risk window are advised to perform clean OS reinstalls and change passwords from trusted devices.

Indicators of Compromise

• hash: 5a6636ce490789d7f26aaa86e50bd65c7330f8e6a7c32418740c1d009fb12ef3
• hash: c19d686e686b6b391a4e6583bc7909fb
• hash: ee4346d277995bf40196c054de1627f4
• hash: 8ce6e138f3df020612acb0826cb952bff24294b9
• hash: e5ac58f956fc17d07435c311fdedcd9885fbb09d
• hash: 04cb9f0bca6e0e4ed30bc92726590724bf60938440b3825252657d1b3af45495
• hash: 32891c0080442bf0a0c5658ada2c3845435b4e09b114599a516248723aad7805
• hash: 4ff7eec9e69b6008b77de1b6e5c0d18aa717f625458d80da610cb170c784e97c
• hash: 6d975c05ef7a164707fa359284a31bfe0b1681fe0319819cb9e2c4eec2a1a8af
• hash: de8b2bdfc61d63585329b8cfca2a012476b46387435410b995aeae5b502bd95e
• hash: e4a20f746b7dd19b8d9601b884e67c8166ea9676b917adea6833b695ba13de16
• hash: fb1e3fe4d18927ff82cffb3f82a0b4ffb7280c85db5a8a8b6f6a1ac30a7e7ed9
• hash: be430657cf97c5b1f3fa1abd496a4f3b
• hash: 6839bd5a42338c41e81bb9aff8c4ed853d93801e