JDownloader website hacked to serve malware via Windows and Linux installers

JDownloader’s official website was breached and used to distribute malware through installer downloads for over a day before the issue was confirmed. Attackers exploited an unpatched website vulnerability, gaining the ability to alter access control settings and modify download links. This allowed them to replace all alternative Windows installer links with malicious unsigned executables, marked by the unusual publisher “Zipline LLC” rather than the expected “AppWork.”

On Linux, the shell installer was also swapped for a version containing malicious shell code. However, following user reports and Windows SmartScreen warnings, the team responded by taking the website offline while conducting a full investigation. The breach did not affect the main JDownloader.jar file or macOS installers. Packages released via WinGet, Flatpak, and Snap, as well as in-app updates, remained safe due to independent infrastructure and signature protections. Some users who ran the compromised installers experienced malware that allegedly disabled Windows Defender.

The incident fits a supply chain style attack because it abused JDownloader’s reputation and website traffic to spread malware directly to end users, echoing another recent attack where CPUID website was compromises by hackers that used the official site behind CPU-Z and HWMonitor to distribute a suspicious installer.