JDownloader Website Supply Chain Compromise — Trojanized Windows/Linux Installers Deploy Pyarmor-Obfuscated Python RAT (May 6-7, 2026)

JDownloader Website Supply Chain Compromise (TL-2026-0490), also tracked as JDownloader Site Hack May 2026, is a high-severity supply-chain compromise, first published 2026-05-09. It has no confirmed attribution, affects Appwork GmbH JDownloader Windows Alternative Installer, maps to 25 MITRE ATT&CK techniques (T1027, T1027.002, T1036.003), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-0490

Threat ID
TL-2026-0490
Also known as
JDownloader Site Hack May 2026, Appwork Website Compromise, JDownloader Installer Swap
Severity
HIGH
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-05-09
Last reviewed
2026-05-09
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
consumer, small-business, education, media-and-entertainment, technology
Target regions
Global, Europe, North America, Asia
Detection rules
9
Indicators of compromise
24

Malware and tooling in JDownloader Website Supply Chain Compromise

Malware and tooling: Python RAT (modular, Pyarmor-packed, unattributed), Pyarmor

Between May 6, 2026 00:01 UTC and May 7, 2026, the official JDownloader website (Appwork GmbH) was compromised via an unauthenticated CMS access-control vulnerability that allowed attackers to modify website ACLs and replace the Windows 'Download Alternative Installer' and Linux shell installer download links with malicious payloads. The Windows payload is an unsigned loader masquerading under spoofed publisher names ('Zipline LLC', 'The Water Team', 'Peace Team') that drops a Pyarmor-obfuscated Python-based modular RAT framework. The Linux payload is a multi-stage ELF chain (pkg, systemd-exec) staged from compromised hospitality websites (checkinnhotels[.]com), installed as a SUID-root binary in /usr/bin/ and persisted via /etc/profile.d/systemd.sh while masquerading as /usr/libexec/upowerd. In-app updates, macOS downloads, the JDownloader.jar core, and Flatpak/Winget/Snap packages were not affected. C2 endpoints observed: parkspringshotel[.]com/m/Lu6aeloo.php and auraguest[.]lk/m/douV2quu.php. Microsoft Defender SmartScreen flagged the trojanized installers in the wild; the breach was first reported May 7, 2026 by a Reddit user observing unexpected publisher names on signed-installer prompts.

How JDownloader Website Supply Chain Compromise works

## Overview

On May 6, 2026 at 00:01 UTC, threat actors compromised the official JDownloader website (jdownloader.org), operated by Appwork GmbH, by exploiting an unpatched, unauthenticated vulnerability in the website's content management system that permitted modification of access control lists (ACLs) and published page content without requiring valid credentials. The attackers used this access to swap the legitimate download URLs on the 'Download Alternative Installer' page (Windows .exe) and the Linux shell installer page with attacker-controlled malicious payloads. The compromise was limited to website ACLs and published page content; the underlying server stack, host filesystem, build pipeline, code-signing keys, and in-app update infrastructure were not accessed.

The attack was carefully staged. At 23:55 UTC on May 5, 2026, the threat actors first tested their methodology by modifying a dummy page on the same site to confirm the ACL-bypass exploit would work. Six minutes later, at 00:01 UTC on May 6, they executed the live attack, replacing real download links. The malicious installers remained available on the official domain for over 24 hours before being detected.

## Discovery

The breach was first publicly flagged on May 7, 2026 by a Reddit user posting under the handle 'PrinceOfNightSky', who reported that every Windows executable freshly downloaded from the official JDownloader site triggered Windows SmartScreen warnings and listed unexpected publisher names — 'Zipline LLC', 'The Water Team', and 'Peace Team' — instead of the legitimate publisher 'AppWork GmbH'. Within hours, an Appwork developer (handle 'jdownloader_dev') confirmed the compromise and took the affected pages offline for investigation. The vendor publicly stated: 'Updates are not affected. Only the website has been compromised by replacing links to compromised installers.' Clean files were subsequently restored from backups; the site was placed in read-only mode while the CMS vulnerability was patched and server configurations were hardened.

## Windows Payload Chain

The Windows installer (the trojanized 'Download Alternative Installer' .exe) is a loader signed (or pseudo-signed) under spoofed code-signing publisher names that mimic the look of legitimate AppWork GmbH binaries: 'Zipline LLC', 'The Water Team', and 'Peace Team' have all been observed on collected samples. On execution, the loader writes and launches a Pyarmor-obfuscated Python-based remote access trojan that operates as a modular bot/RAT framework, providing the operator with arbitrary Python code execution, command staging, and post-exploitation tasking on the victim host. The use of pythonw.exe at runtime allows the RAT to execute silently without spawning a visible console window. Because the trojanized binary is unsigned with a valid AppWork certificate (the legitimate publisher), Microsoft Defender SmartScreen flagged the file in the wild — which is what tipped off the original Reddit reporter and triggered downstream detection by Microsoft Defender Antivirus.

## Linux Payload Chain

The Linux installer is a malicious shell script (delivered via the swapped 'Linux Installer' link, observed naming convention `nojre.sh`-class) that downloads a secondary payload archive disguised with an .svg extension from the compromised hospitality website checkinnhotels[.]com. The archive contains two ELF binaries:

- `pkg` — the main payload, obfuscated using Pyarmor (a commercial Python obfuscator increasingly weaponized by adversaries for detection evasion); copied to `/root/.local/share/.pkg`. - `systemd-exec` — a SUID-root component installed under `/usr/bin/systemd-exec`, providing privilege-elevation capability; additionally the threat masquerades as a legitimate system component by impersonating `/usr/libexec/upowerd`.

Persistence is achieved via `/etc/profile.d/systemd.sh`, which causes the RAT to start in every interactive login shell session. Both payloads beacon to attacker-controlled PHP endpoints on compromised hospitality sites: `parkspringshotel[.]com/m/Lu6aeloo.php` and `auraguest[.]lk/m/douV2quu.php`. The use of compromised legitimate domains for staging and C2 is consistent with budget-conscious cybercriminal tradecraft and complicates network-level blocklisting.

## Scope and Non-Affected Components

The following components were explicitly confirmed by Appwork and independent research as **not** compromised:

- The core JDownloader.jar package (cryptographic checksums unchanged). - macOS installers (digital signatures by AppWork GmbH validated throughout). - The in-app update mechanism (separate infrastructure protected by end-to-end digital signatures). - Flatpak, Winget, and Snap distributions (separate package infrastructure with verified SHA-256 checksums). - Third-party Docker images.

## Attribution and Motivation

No formal attribution has been published as of May 9, 2026. The tradecraft (CMS ACL exploitation, compromised hospitality-sector infrastructure for staging/C2, Pyarmor-obfuscated Python RAT, cross-platform targeting of a legitimate freeware brand with millions of users) is consistent with financially motivated cybercrime — likely an information-stealer or commodity-RAT operator seeking broad access to consumer endpoints. Pyarmor-obfuscated Python RATs are also associated with prior infostealer campaigns such as the VVS Discord stealer ecosystem, but no direct lineage has been established. Attribution confidence is LOW.

## Risk and Defender Implications

Any user who downloaded the Windows 'Alternative Installer' or Linux shell installer from jdownloader.org between May 6, 2026 00:01 UTC and the takedown on May 7, 2026 should treat the affected endpoint as fully compromised. Recommended response: full credential rotation for accounts used on the host, complete OS reinstallation, and EDR sweep for the documented IOCs across the rest of the environment. Defenders should retroactively hunt their proxy/DNS telemetry for the C2 domains, hashes, and Linux persistence paths listed in this advisory and pivot from any matches.

MITRE ATT&CK techniques used in TL-2026-0490

Defense Evasion

T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information: Software Packing; T1036.003 Rename Legitimate Utilities; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hide Artifacts: Hidden Files and Directories

Persistence

T1037 Boot or Logon Initialization Scripts; T1546.004 Event Triggered Execution: Unix Shell Configuration Modification

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery

Initial Access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Privilege Escalation

T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid

defense-impairment

T1553.002 Subvert Trust Controls: Code Signing

Credential Access

T1555 Credentials from Password Stores

Resource Development

T1584 Compromise Infrastructure; T1584.001 Compromise Infrastructure: Domains; T1588.003 Obtain Capabilities: Code Signing Certificates; T1608.001 Stage Capabilities: Upload Malware

Affected products and versions in JDownloader Website Supply Chain Compromise

  • Appwork GmbH — JDownloader Windows Alternative Installer
    Vulnerable versions: Any installer downloaded from jdownloader.org Alternative Installer link between 2026-05-06 00:01 UTC and 2026-05-07 takedown
    Fixed in: Installers downloaded after 2026-05-08 (clean files restored from backup; CMS patched)
  • Appwork GmbH — JDownloader Linux Shell Installer
    Vulnerable versions: Any Linux .sh installer downloaded from jdownloader.org between 2026-05-06 00:01 UTC and 2026-05-07 takedown
    Fixed in: Installers downloaded after 2026-05-08 (clean files restored from backup; CMS patched)
  • Appwork GmbH — JDownloader Website CMS
    Vulnerable versions: Pre-2026-05-08 deployment of the jdownloader.org content management system (specific CMS not publicly disclosed)
    Fixed in: Hardened CMS deployment as of 2026-05-08
  • Appwork GmbH — JDownloader macOS Installer
    Fixed in: Not affected — valid AppWork GmbH digital signatures preserved throughout the incident
  • Appwork GmbH — JDownloader.jar (core)
    Fixed in: Not affected — checksums unchanged
  • Appwork GmbH — JDownloader Flatpak / Winget / Snap packages
    Fixed in: Not affected — separate package infrastructure with verified SHA-256 checksums
  • Appwork GmbH — JDownloader In-App Update Channel
    Fixed in: Not affected — separate infrastructure protected by end-to-end digital signatures

Remediation for JDownloader Website Supply Chain Compromise

Patches

  • No CVE was issued; the underlying vulnerability is in the JDownloader website's CMS, not in the JDownloader application itself. Appwork patched the CMS vulnerability and hardened server configuration as of 2026-05-08 and restored clean installers from backup.
  • No application-level patch is required for JDownloader — the JDownloader.jar core was not modified.

Immediate actions

  • If JDownloader Windows Alternative Installer or Linux shell installer was downloaded between 2026-05-06 00:01 UTC and 2026-05-07 takedown, treat the host as fully compromised: isolate from network, capture forensic image if required, then reinstall the operating system from clean media.
  • Rotate every credential, session token, browser cookie, and SSH key entered or stored on the affected host since download time — the Python RAT supports arbitrary code execution and credential theft.
  • Block the C2 hostnames parkspringshotel[.]com and auraguest[.]lk and the staging host checkinnhotels[.]com (and resolved IPs 172.96.172.91, 209.133.215.178, 66.29.137.25) at perimeter DNS, web proxy, and firewall.
  • Hunt EDR/SIEM telemetry for SmartScreen events with publisher = 'Zipline LLC', 'The Water Team', or 'Peace Team' over the past 14 days — these are the spoofed publisher strings on the trojanized Windows installer.
  • On Linux endpoints, hunt for the persistence path /etc/profile.d/systemd.sh, the staged binary /root/.local/share/.pkg, and a SUID-root /usr/bin/systemd-exec that does not belong to a known package.

Workarounds

  • Until further confirmation, prefer the JDownloader Flatpak/Winget/Snap packages or in-app update over direct .exe / .sh downloads from jdownloader.org.
  • On Windows, treat any AppWork .exe whose Authenticode publisher does not read 'AppWork GmbH' as malicious.

Longer-term hardening

  • Standardize on package-manager distribution channels (Winget, Flatpak, Snap, official OS repositories) over direct vendor-website downloads where possible — these channels carry separate end-to-end signature chains that survived this incident.
  • Validate publisher chain on every signed-installer SmartScreen prompt — train users that an unexpected publisher name on a known vendor's binary is a high-fidelity supply-chain compromise indicator.
  • Deploy EDR with behavioral detection for Pyarmor-packed Python interpreters launched by recently-installed application stubs (pythonw.exe spawned from temp/AppData paths shortly after .exe install).
  • Monitor download-source allowlists; require code-signing publisher pinning for high-value freeware where supported.

Weaknesses (CWE) in JDownloader Website Supply Chain Compromise

CWE-284, CWE-862, CWE-494, CWE-693

Timeline of JDownloader Website Supply Chain Compromise

  • 23:55 UTC — Threat actors test their CMS ACL-bypass exploit by modifying a non-production dummy page on jdownloader.org to confirm the unauthenticated content/ACL modification works as expected.
  • Malicious installers actively served from the legitimate jdownloader.org domain to a global user base for over 24 hours; Microsoft Defender SmartScreen begins flagging fresh downloads with unrecognized publishers ('Zipline LLC', 'The Water Team', 'Peace Team').
  • 00:01 UTC — Live supply-chain attack executed: attackers replace the Windows 'Download Alternative Installer' link and the Linux shell installer link on jdownloader.org with malicious payloads (trojanized .exe with spoofed publisher, malicious .sh that stages ELF binaries from checkinnhotels[.]com).
  • An Appwork developer ('jdownloader_dev') confirms the compromise within hours of the Reddit post, takes affected pages offline, and publicly states: 'Updates are not affected. Only the website has been compromised by replacing links to compromised installers.'
  • Reddit user 'PrinceOfNightSky' publicly reports that JDownloader Windows installers from the official site are being flagged by SmartScreen and showing unexpected publisher strings — first public disclosure of the breach.
  • Multiple security outlets (PiunikaWeb, Cyber Kendra, SecurityOnline, Neowin) publish coverage of the incident, including the spoofed publisher names and the affected/unaffected component list.
  • Appwork restores clean installers from backups, places the site in read-only mode, and patches the underlying CMS access-control vulnerability while hardening server configuration.
  • Threadlinqs Intelligence (TL-2026-0490) published with consolidated IOC list, MITRE mapping, and detection guidance.
  • BleepingComputer publishes the most detailed technical writeup, naming the Pyarmor-obfuscated Python RAT, the Linux ELF chain (pkg, systemd-exec), the persistence path /etc/profile.d/systemd.sh, the masquerading as /usr/libexec/upowerd, the SUID-root staging at /usr/bin/, the staging via .svg-disguised archive from checkinnhotels[.]com, and the C2 endpoints parkspringshotel[.]com/m/Lu6aeloo.php and auraguest[.]lk/m/douV2quu.php.
  • As of 2026-05-29, the JDownloader.org website compromise is contained: Appwork pulled the trojanized installers within ~18 min of the May 7 report, restored clean files from backup, and patched the CMS access-control flaw (no CVE, app core untouched). No resurgence, but the unattributed financially-motivated operator and its modular Pyarmor Python RAT remain at large and could retarget, so monitoring continues.

Sources cited for JDownloader Website Supply Chain Compromise

Threats related to JDownloader Website Supply Chain Compromise

Detection coverage for TL-2026-0490

As of 2026-05-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0490 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats