JDownloader Website Supply-Chain Compromise Distributes Trojanized Installers (Python RAT / Linux Persistence Malware)

JDownloader Website Supply-Chain Compromise Distributes (TL-2026-1142) is a high-severity supply-chain compromise, first published 2026-07-06. It has no confirmed attribution, affects AppWork GmbH JDownloader Windows Alternative Installer, maps to 34 MITRE ATT&CK techniques (T1014, T1027.002, T1027.007), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-1142

Threat ID
TL-2026-1142
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-07-06
Last reviewed
2026-07-06
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
consumer, technology, general public
Target regions
Global
Detection rules
9
Indicators of compromise
27

Malware and tooling in JDownloader Website Supply-Chain Compromise Distributes

Malware and tooling: JDownloader Supply-Chain Python RAT, r77, Kernel32Trap, PyArmor

Attackers exploited an unauthenticated CMS flaw on jdownloader.org between May 6-7, 2026 to swap the Windows 'Alternative Installer' and Linux shell installer download links with trojanized binaries. The Windows payload bundled the legitimate installer with a PyArmor-obfuscated Python RAT, an r77 rootkit with an AMSI bypass, and a malicious Windows Defender Application Control (WDAC) policy that disabled 50 security-vendor executables including Microsoft Defender; the Linux payload installed a SUID-root ELF binary masquerading as a system process. Sophos Endpoint's Kernel32Trap exploit mitigation (targeting MITRE ATT&CK T1027.007, Dynamic API Resolution) blocked the trojanized Windows installer on 11 distinct customer endpoints between May 6 and May 8, 2026, ahead of the JDownloader team completing remediation.

How JDownloader Website Supply-Chain Compromise Distributes works

Between approximately 23:55 UTC on May 5, 2026 and 00:01 UTC on May 6, 2026, unknown attackers conducted a dry run and then live exploitation of an unpatched, unauthenticated vulnerability in the content management system powering the official JDownloader download manager website (jdownloader.org). The flaw allowed the attackers to modify the site's access control lists and page content without any authentication, and they used this access to repoint the 'Download Alternative Installer' link (Windows) and the Linux shell installer link to attacker-controlled infrastructure. The underlying application server and the JDownloader software itself were not compromised; only the CMS-managed download page content was altered. No CVE identifier has been publicly assigned to this website-side flaw.

For approximately 41 hours (May 6-7, 2026), any visitor who used the affected links received a malicious build. The Windows package was an unsigned or fraudulently-signed wrapper (observed publisher names 'Zipline LLC' and 'The Water Team', in contrast to the legitimate publisher 'AppWork GmbH') that bundled the authentic JDownloader installer alongside a second, XOR-encrypted executable. That executable was decoded with the XOR key 'ectb' to reveal a Windows x64 loader, which in turn decrypted further embedded resources using the key 'fywo' to unpack a PyArmor-protected Python payload (reported as Python 3.14, PyArmor generation 8/9 depending on source). The resulting multi-component framework consisted of: (1) a modular Python bot/RAT capable of executing arbitrary Python code pushed from C2; (2) an r77 rootkit stager that first performs an AMSI bypass (an embedded .NET assembly drives a PowerShell cradle that patches AmsiScanBuffer in memory) and then injects 32-bit and 64-bit r77 hooking DLLs into winlogon.exe, hiding any process, file, or registry key whose name is prefixed '$77'; and (3) a malicious Windows Defender Application Control (WDAC) policy written to %WINDIR%\System32\CodeIntegrity\SIPolicy.p7b that deny-lists roughly 50 executable paths spanning six security vendors (Avast, AVG, Avira, Windows Defender, HitmanPro, Kaspersky Virus Removal Tool) plus core Windows security services -- after the next reboot, none of those tools can start. The dropper delays activation by roughly eight minutes to evade automated sandbox analysis, creates the mutex Global\0C3C1D37, and writes an RC4-encrypted, hex-encoded bot configuration to HKCU\SOFTWARE\Python containing a CampaignID and a DDRList of six dead-drop-resolver (DDR) URLs. The bot periodically fetches those DDR pages, RC4-decrypts the content to obtain live C2 addresses, and has been observed calling out to parkspringshotel.com/m/Lu6aeloo.php and auraguest.lk/m/douV2quu.php. Reported RAT capabilities include keystroke logging, screenshot capture, webcam/microphone capture, browser-stored credential harvesting, arbitrary Python code execution, additional payload retrieval, and C2-directed data exfiltration.

The Linux shell installer (JDownloader2Setup_unix_nojre.sh) had malicious shell code injected into it that downloads an archive disguised as an SVG image from checkinnhotels.com. The archive contains two ELF binaries, 'pkg' and 'systemd-exec'. The installer places 'systemd-exec' as a SUID-root binary in /usr/bin/, copies the main payload to /root/.local/share/.pkg, drops a persistence script at /etc/profile.d/systemd.sh, and executes the malware while masquerading as the legitimate desktop process /usr/libexec/upowerd.

Sophos reported that its Kernel32Trap exploit mitigation -- one of more than 60 proprietary, signature-less exploit mitigations enabled by default in Sophos Endpoint -- fired on 11 distinct customer endpoints between May 6 and May 8, 2026, blocking execution of the trojanized Windows installer in every case. Kernel32Trap targets MITRE ATT&CK T1027.007 (Dynamic API Resolution), the near-universal pattern of shellcode/loaders resolving Windows API functions at runtime instead of declaring them in the import table, and required no cloud lookup, signature, or prior knowledge of the campaign to block it.

The compromise was first surfaced publicly on May 7, 2026 at approximately 17:06 UTC when a Reddit user, 'PrinceOfNightSky', reported that an installer downloaded from the official JDownloader site triggered a Microsoft Defender alert. Eighteen minutes later (17:24 UTC), JDownloader developers confirmed the compromise and took the web server offline for investigation, closing the roughly 41-hour exposure window. The team subsequently patched the CMS access-control vulnerability and hardened server configuration, restoring the site on May 8-9, 2026 with verified clean installer links. In-app auto-updates, macOS downloads, the Flatpak/Winget/Snap packages, and the standalone JAR package were never affected. Users who ran the malicious installers during the compromise window are advised that antivirus removal cannot be relied upon given the rootkit and AV-tampering components, and should fully reinstall the operating system and rotate all credentials used on the affected host.

No threat actor has been publicly attributed to this campaign. Security researchers have noted a contemporaneous, technically distinct supply-chain compromise of DAEMON Tools installers in the same month (using valid, stolen/abused code-signing certificates over a longer ~27-day stealth window) but have not established a common actor or shared infrastructure between the two incidents; they are treated here as separate, unattributed campaigns that both targeted trust in popular utility-software distribution channels. The breadth of RAT capability (keylogging, webcam/mic capture, browser credential theft) is consistent with financially-motivated commodity crimeware distributed opportunistically to JDownloader's broad consumer user base, though this motivation assessment is inferred from tooling rather than confirmed by direct attribution evidence.

MITRE ATT&CK techniques used in TL-2026-1142

Defense Evasion

T1014 Rootkit; T1027.002 Software Packing; T1027.007 Dynamic API Resolution; T1036.005 Match Legitimate Resource Name or Location; T1497.003 Time Based Checks

Persistence

T1037.004 RC Scripts

Exfiltration

T1041 Exfiltration Over C2 Channel

Privilege Escalation

T1055.001 Dynamic-link Library Injection; T1548.001 Setuid and Setgid

Collection

T1056.001 Keylogging; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture

Execution

T1059.001 PowerShell; T1059.004 Unix Shell; T1059.006 Python; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1573.001 Symmetric Cryptography

Discovery

T1082 System Information Discovery; T1518.001 Security Software Discovery

defense-impairment

T1112 Modify Registry; T1553.002 Code Signing; T1685 Disable or Modify Tools

Initial Access

T1195.002 Compromise Software Supply Chain

Credential Access

T1555.003 Credentials from Web Browsers

Lateral Movement

T1570 Lateral Tool Transfer

Resource Development

T1583.001 Domains; T1587.001 Malware; T1588.003 Code Signing Certificates; T1608.001 Upload Malware

Affected products and versions in JDownloader Website Supply-Chain Compromise Distributes

  • AppWork GmbH — JDownloader Windows Alternative Installer
    Vulnerable versions: Installer served via jdownloader.org 'Download Alternative Installer' link between 2026-05-06 and 2026-05-07
    Fixed in: Installer served after site remediation and restoration on 2026-05-08/2026-05-09
  • AppWork GmbH — JDownloader Linux shell installer (JDownloader2Setup_unix_nojre.sh)
    Vulnerable versions: Shell installer served via jdownloader.org between 2026-05-06 and 2026-05-07
    Fixed in: Shell installer served after site remediation and restoration on 2026-05-08/2026-05-09

Remediation for JDownloader Website Supply-Chain Compromise Distributes

Patches

  • AppWork GmbH (JDownloader operators) patched the underlying website CMS access-control vulnerability and hardened server configuration; no client-side JDownloader application patch was required
  • No CVE identifier has been publicly assigned to the website CMS flaw as of this writing

Immediate actions

  • Verify any JDownloader installer's digital signature is signed by the legitimate publisher AppWork GmbH before executing; treat installers signed by 'Zipline LLC', 'The Water Team', or unsigned as malicious
  • Block outbound network access to parkspringshotel.com, auraguest.lk, and checkinnhotels.com at DNS/proxy/firewall layers
  • Hunt Windows endpoints for the mutex Global\0C3C1D37, the registry key HKCU\SOFTWARE\Python, and the file %WINDIR%\System32\CodeIntegrity\SIPolicy.p7b
  • Hunt Linux hosts that ran JDownloader2Setup_unix_nojre.sh between 2026-05-06 and 2026-05-07 for /root/.local/share/.pkg, /etc/profile.d/systemd.sh, and a SUID-root /usr/bin/systemd-exec binary masquerading as /usr/libexec/upowerd
  • Treat any host that executed the trojanized installer during the compromise window as fully compromised: reimage/reinstall the OS rather than relying on AV removal (the rootkit and WDAC-based AV tampering can survive scans), and rotate all credentials used on that host

Workarounds

  • Download JDownloader only via the in-app auto-updater, the standalone JAR package, or the official Flatpak/Winget/Snap packages, none of which were affected by the compromise
  • Verify installer checksums/signatures against vendor-published values where available

Longer-term hardening

  • Deploy EDR/exploit-mitigation technology capable of detecting dynamic API resolution (T1027.007) and unauthorized WDAC/SIPolicy.p7b deployment without relying solely on signatures
  • Monitor and alert on unauthorized modifications to %WINDIR%\System32\CodeIntegrity\SIPolicy.p7b and unexpected AMSI provider/AmsiScanBuffer patching
  • Establish code-signing and checksum verification pipelines for third-party open-source utilities before internal distribution
  • Educate users to prefer signed in-app auto-update channels or official package managers over 'alternative installer' download links

Weaknesses (CWE) in JDownloader Website Supply-Chain Compromise Distributes

CWE-306, CWE-284

Timeline of JDownloader Website Supply-Chain Compromise Distributes

  • Attackers tested their CMS exploit against a low-traffic dummy page on jdownloader.org at approximately 23:55 UTC to validate the attack method before going live.
  • Malicious installers began being served to visitors of the official JDownloader download page; the Windows payload delivered a PyArmor-obfuscated Python RAT plus r77 rootkit and AV-disabling WDAC policy, while the Linux payload installed a SUID-root ELF persistence mechanism.
  • At approximately 00:01 UTC, six minutes after the dry run, attackers exploited the unauthenticated CMS access-control vulnerability to repoint the live Windows 'Alternative Installer' and Linux shell installer download links to attacker-controlled servers.
  • Approximately 18 minutes after the Reddit report (17:24 UTC), JDownloader developers confirmed the site compromise and took the web server offline for investigation, closing a roughly 41-hour exposure window.
  • Reddit user 'PrinceOfNightSky' reported at approximately 17:06 UTC that a JDownloader installer downloaded from the official site triggered a Microsoft Defender alert, first surfacing the compromise publicly.
  • JDownloader developers (AppWork GmbH) patched the CMS access-control vulnerability and hardened the web server configuration.
  • Sophos Endpoint's Kernel32Trap exploit mitigation (targeting MITRE ATT&CK T1027.007, Dynamic API Resolution) blocked execution of the trojanized Windows installer on 11 distinct customer endpoints between May 6 and May 8, 2026, without any signature or cloud lookup.
  • jdownloader.org was restored with verified clean installer links; users who had run the malicious installers during the compromise window were advised to fully reinstall their operating systems and rotate all credentials rather than rely on antivirus removal.

Sources cited for JDownloader Website Supply-Chain Compromise Distributes

Threats related to JDownloader Website Supply-Chain Compromise Distributes

Detection coverage for TL-2026-1142

As of 2026-07-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1142 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1142

4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats