Website installer incident (May 2026)

In early May 2026, attackers compromised the official JDownloader website by manipulating specific installer download links through the content management system. Between May 6-7, 2026 (UTC), users who downloaded Windows installers via "Download Alternative Installer" links or the Linux shell installer were redirected to malicious third-party files instead of genuine installers. The attackers gained CMS-level access only, not server or filesystem control. The incident was detected on May 7 via Reddit alerts, and the server was immediately taken offline. Malicious links were removed, legitimate links restored, and security hardened before the site resumed normal operations on May 8-9. In-app updates and other download paths remained unaffected. Users who executed downloaded installers during the risk window are advised to perform clean OS reinstalls and change passwords from trusted devices.

• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksMalware2026-10-23
• Midnight Mimosa Malware Campaign Exploits Android Firmware Supply ChainMalware2026-10-20
• Implants in the Supply ChainMalware2026-08-27
• 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing PayloadsCampaign2026-08-27
• Defending SaaS-based applications against ShinyHunters OAuth abuseUnknown2026-07-14