# JDownloader Website Supply Chain Compromise — Trojanized Windows/Linux Installers Deploy Pyarmor-Obfuscated Python RAT (May 6-7, 2026)

> Between May 6, 2026 00:01 UTC and May 7, 2026, the official JDownloader website (Appwork GmbH) was compromised via an unauthenticated CMS access-control vulnerability that allowed attackers to modify website ACLs and replace the Windows 'Download Alternative Installer' and Linux shell installer download links with malicious payloads. The Windows payload is an unsigned loader masquerading under spoofed publisher names ('Zipline LLC', 'The Water Team', 'Peace Team') that drops a Pyarmor-obfuscated Python-based modular RAT framework. The Linux payload is a multi-stage ELF chain (pkg, systemd-exec) staged from compromised hospitality websites (checkinnhotels[.]com), installed as a SUID-root binary in /usr/bin/ and persisted via /etc/profile.d/systemd.sh while masquerading as /usr/libexec/upowerd. In-app updates, macOS downloads, the JDownloader.jar core, and Flatpak/Winget/Snap packages were not affected. C2 endpoints observed: parkspringshotel[.]com/m/Lu6aeloo.php and auraguest[.]lk/m/douV2quu.php. Microsoft Defender SmartScreen flagged the trojanized installers in the wild; the breach was first reported May 7, 2026 by a Reddit user observing unexpected publisher names on signed-installer prompts.

- **Published:** 2026-05-09T12:00:00Z
- **Last reviewed:** 2026-05-09T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0490
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-jdownloader-installer-hack-tl-2026-0490.webp?v=4dbc1bdf (Threadlinqs threat intel: JDownloader Pyarmor RAT Installers: Detection & IOCs (TL-2026-0490) — High severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-0490
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

## Overview

On May 6, 2026 at 00:01 UTC, threat actors compromised the official JDownloader website (jdownloader.org), operated by Appwork GmbH, by exploiting an unpatched, unauthenticated vulnerability in the website's content management system that permitted modification of access control lists (ACLs) and published page content without requiring valid credentials. The attackers used this access to swap the legitimate download URLs on the 'Download Alternative Installer' page (Windows .exe) and the Linux shell installer page with attacker-controlled malicious payloads. The compromise was limited to website ACLs and published page content; the underlying server stack, host filesystem, build pipeline, code-signing keys, and in-app update infrastructure were not accessed.

The attack was carefully staged. At 23:55 UTC on May 5, 2026, the threat actors first tested their methodology by modifying a dummy page on the same site to confirm the ACL-bypass exploit would work. Six minutes later, at 00:01 UTC on May 6, they executed the live attack, replacing real download links. The malicious installers remained available on the official domain for over 24 hours before being detected.

## Discovery

The breach was first publicly flagged on May 7, 2026 by a Reddit user posting under the handle 'PrinceOfNightSky', who reported that every Windows executable freshly downloaded from the official JDownloader site triggered Windows SmartScreen warnings and listed unexpected publisher names — 'Zipline LLC', 'The Water Team', and 'Peace Team' — instead of the legitimate publisher 'AppWork GmbH'. Within hours, an Appwork developer (handle 'jdownloader_dev') confirmed the compromise and took the affected pages offline for investigation. The vendor publicly stated: 'Updates are not affected. Only the website has been compromised by replacing links to compromised installers.' Clean files were subsequently restored from backups; the site was placed in read-only mode while the CMS vulnerability was patched and server configurations were hardened.

## Windows Payload Chain

The Windows installer (the trojanized 'Download Alternative Installer' .exe) is a loader signed (or pseudo-signed) under spoofed code-signing publisher names that mimic the look of legitimate AppWork GmbH binaries: 'Zipline LLC', 'The Water Team', and 'Peace Team' have all been observed on collected samples. On execution, the loader writes and launches a Pyarmor-obfuscated Python-based remote access trojan that operates as a modular bot/RAT framework, providing the operator with arbitrary Python code execution, command staging, and post-exploitation tasking on the victim host. The use of pythonw.exe at runtime allows the RAT to execute silently without spawning a visible console window. Because the trojanized binary is unsigned with a valid AppWork certificate (the legitimate publisher), Microsoft Defender SmartScreen flagged the file in the wild — which is what tipped off the original Reddit reporter and triggered downstream detection by Microsoft Defender Antivirus.

## Linux Payload Chain

The Linux installer is a malicious shell script (delivered via the swapped 'Linux Installer' link, observed naming convention `nojre.sh`-class) that downloads a secondary payload archive disguised with an .svg extension from the compromised hospitality website checkinnhotels[.]com. The archive contains two ELF binaries:

- `pkg` — the main payload, obfuscated using Pyarmor (a commercial Python obfuscator increasingly weaponized by adversaries for detection evasion); copied to `/root/.local/share/.pkg`.
- `systemd-exec` — a SUID-root component installed under `/usr/bin/systemd-exec`, providing privilege-elevation capability; additionally the threat masquerades as a legitimate system component by impersonating `/usr/libexec/upowerd`.

Persistence is achieved via `/etc/profile.d/systemd.sh`, which causes the RAT to start in every interactive login shell session. Both payloads beacon to attacker-controlled PHP endpoints on compromised hospitality sites: `parkspringshotel[.]com/m/Lu6aeloo.php` and `auraguest[.]lk/m/douV2quu.php`. The use of compromised legitimate domains for staging and C2 is consistent with budget-conscious cybercriminal tradecraft and complicates network-level blocklisting.

## Scope and Non-Affected Components

The following components were explicitly confirmed by Appwork and independent research as **not** compromised:

- The core JDownloader.jar package (cryptographic checksums unchanged).
- macOS installers (digital signatures by AppWork GmbH validated throughout).
- The in-app update mechanism (separate infrastructure protected by end-to-end digital signatures).
- Flatpak, Winget, and Snap distributions (separate package infrastructure with verified SHA-256 checksums).
- Third-party Docker images.

## Attribution and Motivation

No formal attribution has been published as of May 9, 2026. The tradecraft (CMS ACL exploitation, compromised hospitality-sector infrastructure for staging/C2, Pyarmor-obfuscated Python RAT, cross-platform targeting of a legitimate freeware brand with millions of users) is consistent with financially motivated cybercrime — likely an information-stealer or commodity-RAT operator seeking broad access to consumer endpoints. Pyarmor-obfuscated Python RATs are also associated with prior infostealer campaigns such as the VVS Discord stealer ecosystem, but no direct lineage has been established. Attribution confidence is LOW.

## Risk and Defender Implications

Any user who downloaded the Windows 'Alternative Installer' or Linux shell installer from jdownloader.org between May 6, 2026 00:01 UTC and the takedown on May 7, 2026 should treat the affected endpoint as fully compromised. Recommended response: full credential rotation for accounts used on the host, complete OS reinstallation, and EDR sweep for the documented IOCs across the rest of the environment. Defenders should retroactively hunt their proxy/DNS telemetry for the C2 domains, hashes, and Linux persistence paths listed in this advisory and pivot from any matches.

## MITRE ATT&CK

- T1584 Compromise Infrastructure
- T1584.001 Compromise Infrastructure: Domains
- T1608.001 Stage Capabilities: Upload Malware
- T1588.003 Obtain Capabilities: Code Signing Certificates
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1204.002 User Execution: Malicious File
- T1059.006 Command and Scripting Interpreter: Python
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1546.004 Event Triggered Execution: Unix Shell Configuration Modification
- T1037 Boot or Logon Initialization Scripts
- T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
- T1553.002 Subvert Trust Controls: Code Signing
- T1036.005 Match Legitimate Resource Name or Location
- T1036.003 Rename Legitimate Utilities
- T1027 Obfuscated Files or Information
- T1027.002 Obfuscated Files or Information: Software Packing
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Pyarmor RAT Persistence — Win Run-Key & Linux profile.d / SUID / Pyarmor payload** (`TL-2026-0490-SPL-002`)

Splunk detection for the post-exploitation persistence and privilege-escalation artifacts of TL-2026-0490: HKCU\...\Run values pointing pythonw.exe at a script under %TEMP%/%APPDATA%/Downloads (Sysmon EID 13), and Linux file events on /etc/profile.d/systemd.sh, the SUID-root /usr/bin/systemd-exec, the hidden $HOME/.local/share/.pkg payload, and the /usr/libexec/upowerd masquerade target.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1547.001, T1546.004, T1548.001, T1036.003, T1564.001, T1037
- **Data sources:** sysmon, auditd, linux_file_integrity
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
``` TL-2026-0490-SPL-002 — Pyarmor RAT persistence (Run key + Linux profile.d / SUID artifacts) ```
(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
    TargetObject="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*"
    Details="*pythonw.exe*"
    (Details="*\\Temp\\*" OR Details="*\\AppData\\*" OR Details="*\\Downloads\\*"))
OR (index=linux sourcetype="auditd"
    (key=t1546_profile_d OR key=t1548_suid OR key=t1564_hidden)
    (file_path="/etc/profile.d/systemd.sh"
     OR file_path="/usr/bin/systemd-exec"
     OR file_path="/usr/libexec/upowerd"
     OR file_path="*/.local/share/.pkg"))
| eval phase=case(
    EventCode==13, "win_run_key_pythonw",
    file_path=="/etc/profile.d/systemd.sh", "linux_profile_d_persistence",
    file_path=="/usr/bin/systemd-exec", "linux_suid_root_stage",
    like(file_path,"%/.local/share/.pkg"), "linux_hidden_pyarmor_payload",
    file_path=="/usr/libexec/upowerd", "linux_upowerd_masquerade")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(host) as hosts values(user) as users
        values(TargetObject) as run_keys values(Details) as run_values
        values(file_path) as artifact_paths
        by phase
| eval first_seen=strftime(first_seen,"%Y-%m-%dT%H:%M:%SZ"),
       last_seen=strftime(last_seen,"%Y-%m-%dT%H:%M:%SZ")
| sort - count
````

### Microsoft KQL

```kql
// TL-2026-0490-KQL-002 — Linux persistence + SUID + Pyarmor payload + upowerd masquerade (M365 Defender)
let lookback = 24h;
let PersistencePath = "/etc/profile.d/systemd.sh";
let SuidStage = "/usr/bin/systemd-exec";
let MasqPath = "/usr/libexec/upowerd";
DeviceFileEvents
| where Timestamp > ago(lookback)
| where DeviceOSPlatform startswith "Linux" or DeviceType == "Linux"
| where ActionType in~ ("FileCreated","FileModified","FileRenamed")
| where FolderPath in~ (PersistencePath, SuidStage, MasqPath)
       or FolderPath endswith "/.local/share/.pkg"
| extend artifact_kind = case(
    FolderPath =~ PersistencePath, "linux_profile_d_persistence_T1546.004",
    FolderPath =~ SuidStage, "linux_suid_root_T1548.001",
    FolderPath endswith "/.local/share/.pkg", "linux_hidden_pyarmor_payload_T1564.001",
    FolderPath =~ MasqPath, "linux_upowerd_masquerade_T1036.003",
    "unknown")
| extend writer_is_pkgmgr = InitiatingProcessFileName in~ ("dpkg","rpm","apt","apt-get","yum","dnf","pacman","zypper")
| where not(writer_is_pkgmgr) or artifact_kind in ("linux_suid_root_T1548.001","linux_hidden_pyarmor_payload_T1564.001")
| project Timestamp, DeviceName, ReportId, FolderPath, FileName, SHA256,
          ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessAccountName, artifact_kind
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
            Paths = make_set(FolderPath, 25), Hashes = make_set(SHA256, 25),
            Writers = make_set(InitiatingProcessFileName, 25)
            by DeviceName, artifact_kind
| order by Hits desc
```

### Sigma

```yaml
title: JDownloader Linux Supply-Chain Persistence + SUID Stage + Pyarmor Payload + upowerd Masquerade
id: a4901002-0490-4002-9002-000000000002
status: experimental
description: |
    Detects file artifacts associated with the May 2026 JDownloader Linux supply-chain compromise:
    /etc/profile.d/systemd.sh persistence script, the SUID-root /usr/bin/systemd-exec staging binary,
    the hidden /root/.local/share/.pkg (or any user $HOME/.local/share/.pkg) Pyarmor-packed payload,
    and tampering of /usr/libexec/upowerd (legitimate-name masquerade). Excludes writes performed
    directly by package managers.
references:
    - https://www.bleepingcomputer.com/news/security/jdownloader-site-hacked-to-replace-installers-with-python-rat-malware/
    - https://intel.threadlinqs.com/threats/TL-2026-0490
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/05/09
tags:
    - attack.persistence
    - attack.t1546.004
    - attack.t1037
    - attack.privilege_escalation
    - attack.t1548.001
    - attack.defense_evasion
    - attack.t1036.003
    - attack.t1564.001
logsource:
    product: linux
    category: file_event
detection:
    selection_persist:
        TargetFilename: '/etc/profile.d/systemd.sh'
    selection_suid:
        TargetFilename: '/usr/bin/systemd-exec'
    selection_pkg:
        TargetFilename|endswith: '/.local/share/.pkg'
    selection_masq:
        TargetFilename: '/usr/libexec/upowerd'
    filter_pkgmgr:
        Image|endswith:
            - '/dpkg'
            - '/rpm'
            - '/apt'
            - '/apt-get'
            - '/yum'
            - '/dnf'
            - '/pacman'
            - '/zypper'
    condition: (selection_persist or selection_suid or selection_pkg or selection_masq) and not filter_pkgmgr
falsepositives:
    - Custom systemd packaging on bespoke distributions (verify package owner / file hash before suppressing)
    - Configuration management tools (Ansible, Puppet) writing /etc/profile.d/ — should be allowlisted by Image
level: high

```

**Known false positives:**

- Configuration management tooling (Ansible, Puppet, Chef) writing /etc/profile.d/ — allowlist by writer process
- Bespoke Linux distributions whose package manager itself ships a /usr/bin/systemd-exec (verify package owner)
- Developer Run-key entries pointing pythonw.exe at user-script paths (rare in enterprise)

**Tuning notes:** Pre-stage auditd watch rules: -w /etc/profile.d/ -p wa -k t1546_profile_d / -w /usr/bin/systemd-exec -p wa -k t1548_suid / -w /root/.local/share/.pkg -p wa -k t1564_hidden. For .pkg, also watch every user $HOME — extend the path glob accordingly. Suppress writes whose parent process is dpkg/rpm/apt/dnf/pacman/zypper after validating the package source.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- JDownloader Trojanized Installer & pythonw RAT Loader — M365 Defender Exploitation (locked: unlock with TL Creds)
- Linux Persistence + SUID Stage + Pyarmor Payload + upowerd Masquerade — M365 Defender (locked: unlock with TL Creds)
- JDownloader Pyarmor RAT C2 Beacon — DeviceNetworkEvents (M365 Defender) (locked: unlock with TL Creds)
- Sigma — JDownloader Trojanized Installer Spoofed Publisher / pythonw Loader (locked: unlock with TL Creds)
- Sigma — Linux Persistence / SUID / Pyarmor / upowerd Masquerade (locked: unlock with TL Creds)
- Sigma — JDownloader Pyarmor RAT C2 Beacon /m/<8-alnum>.php (locked: unlock with TL Creds)
- JDownloader Trojanized Installer & pythonw RAT Loader — Exploitation (locked: unlock with TL Creds)
- JDownloader Pyarmor RAT C2 Beacon — /m/<8-alnum>.php & Hospitality C2 Hosts/IPs (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `172.96.172[.]91`
- Domain: `parkspringshotel[.]com`
- IP address: `209.133.215[.]178`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [JDownloader site hacked to replace installers with Python RAT malware](https://www.bleepingcomputer.com/news/security/jdownloader-site-hacked-to-replace-installers-with-python-rat-malware/)
- [JDownloader developers confirm site hack, warn of malicious Windows and Linux installers](https://piunikaweb.com/2026/05/08/jdownloader-website-hacked-malware/)
- [JDownloader Website Hacked — Malicious Installers Served to Windows and Linux Users](https://www.cyberkendra.com/2026/05/jdownloader-website-hacked-malicious.html)
- [Trust Hijacked: Official JDownloader Website Breached to Distribute Malicious Installers](https://securityonline.info/jdownloader-website-breach-malware-installers-swapped/)
- [If you downloaded this popular software recently, you might have installed malware](https://www.neowin.net/news/if-you-downloaded-this-popular-software-recently-you-might-have-installed-malware/)
- [Hackers breach JDownloader's website to serve malware-laced downloads (Hacker News discussion with VirusTotal hash references)](https://news.ycombinator.com/item?id=48062035)
- [Compromised JDownloader Malware (ESET Security Forum thread)](https://forum.eset.com/topic/48973-compromised-jdownloader-malware)
- [Jdownloader.org hacked and offline (Gnoppix Forum discussion)](https://forum.gnoppix.org/t/jdownloader-org-hacked-and-offline/5944)
- [VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion (Pyarmor weaponization context)](https://unit42.paloaltonetworks.com/vvs-stealer/)
- [Obfuscated Malicious Python Scripts with PyArmor (SANS ISC)](https://isc.sans.edu/diary/31840)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0490