JDownloader Website Supply Chain Compromise — Trojanized Windows/Linux Installers Deploy Pyarmor-Obfuscated Python RAT (May 6-7, 2026) — Threadlinqs Intelligence
As of 2026-05-30, JDownloader Website Supply Chain Compromise — Trojanized Windows/Linux Installers Deploy Pyarmor-Obfuscated Python RAT (May 6-7, 2026) is a high-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-0490 · Severity: HIGH · Status: MONITORING · Category: SUPPLY_CHAIN
Between May 6, 2026 00:01 UTC and May 7, 2026, the official JDownloader website (Appwork GmbH) was compromised via an unauthenticated CMS access-control vulnerability that allowed attackers to modify
## Overview
On May 6, 2026 at 00:01 UTC, threat actors compromised the official JDownloader website (jdownloader.org), operated by Appwork GmbH, by exploiting an unpatched, unauthenticated vulnerability in the website's content management system that permitted modification of access control lists (ACLs) and published page content without requiring valid credentials. The attackers used this access to swap the legitimate download URLs on the 'Download Alternative Installer' page (Windows .exe) and the Linux shell installer page with attacker-controlled malicious payloads. The compromise was limited to website ACLs and published page content; the underlying server stack, host filesystem, build pipeline, code-signing keys, and in-app update infrastructure were not accessed.
The attack was carefully staged. At 23:55 UTC on May 5, 2026, the threat actors first tested their methodology by modifying a dummy page on the same site to confirm the ACL-bypass exploit would work. Six minutes later, at 00:01 UTC on May 6, they executed the live attack, replacing real download links. The malicious installers remained available on the official domain for over 24 hours before being detected.
## Discovery
The breach was first publicly flagged on May 7, 2026 by a Reddit user posting under the handle 'PrinceOfNightSky', who reported that every Windows executable freshly downloaded from the official JDownloader site triggered Windows SmartScreen warnings and listed unexpected publisher names — 'Zipline LLC', 'The Water Team', and 'Peace Team' — instead of the legitimate publisher 'AppWork GmbH'. Within hours, an Appwork developer (handle 'jdownloader_dev') confirmed the compromise and took the affected pages offline for investigation. The vendor publicly stated: 'Updates are not affected. Only the website has been compromised by replacing links to compromised installers.' Clean files were subsequently restored from backups; the site was placed in read-only mode while the CMS vulnerability was patched and server configurations were hardened.
## Windows Payload Chain
The Windows installer (the trojanized 'Download Alternative Installer' .exe) is a loader signed (or pseudo-signed) under spoofed code-signing publisher names that mimic the look of legitimate AppWork GmbH binaries: 'Zipline LLC', 'The Water Team', and 'Peace Team' have all been observed on collected samples. On execution, the loader writes and launches a Pyarmor-obfuscated Python-based remote access trojan that operates as a modular bot/RAT framework, providing the operator with arbitrary Python code execution, command staging, and post-exploitation tasking on the victim host. The use of pythonw.exe at runtime allows the RAT to execute silently without spawning a visible console window. Because the trojanized binary is unsigned with a valid AppWork certificate (the legitimate publisher), Microsoft Defender SmartScreen flagged the file in the wild — which is what tipped off the original Reddit reporter and triggered downstream detection by Microsoft Defender Antivirus.
## Linux Payload Chain
The Linux installer is a malicious shell script (delivered via the swapped 'Linux Installer' link, observed naming convention `nojre.sh`-class) that downloads a secondary payload archive disguised with an .svg extension from the compromised hospitality website checkinnhotels[.]com. The archive contains two ELF binaries:
- `pkg` — the main payload, obfuscated using Pyarmor (a commercial Python obfuscator increasingly weaponized by adversaries for detection evasion); copied to `/root/.local/share/.pkg`.
- `systemd-exec` — a SUID-root component installed under `/usr/bin/systemd-exec`, providing privilege-elevation capability; additionally the threat masquerades as a legitimate system component by impersonating `/usr/libexec/upowerd`.
Persistence is achieved via `/etc/profile.d/systemd.sh`, which causes the RAT to start in every interactive login shell session. Both payloads beacon to attacker-c
Weaknesses (CWE)
CWE-284, CWE-862, CWE-494, CWE-693
Target sectors: consumer, small-business, education, media-and-entertainment, technology
Target regions: Global, Europe, North America, Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1584, T1584.001, T1608.001, T1588.003, T1195.002, T1189, T1190, T1204.002, T1059.006, T1059.004