Loading story…
Attackers compromised JDownloader’s official website and replaced legitimate download links with malware-laced installers in a supply-chain-style attack. The breach was traced to an unpatched CMS vulnerability that allowed unauthenticated changes to access control lists, letting the attackers grant themselves edit rights and swap the official URLs. JDownloader said the malicious files were distributed through the Windows Alternative Installer and the Linux shell script on its alternative download page, while the main JDownloader.jar, macOS installers, Winget, Flatpak, Snap packages, and in-app updates were not affected because existing update mechanisms remained protected by RSA-signed verification.
The compromise was discovered after users reported suspicious behavior, including Windows SmartScreen warnings and an unexpected publisher name, in posts on Reddit. JDownloader took the server offline for emergency maintenance, patched and hardened the site, and later restored service. The developers warned that anyone who ran the affected installers during the exposure window on 6 and 7 May should treat the system as fully compromised and consider a complete operating system reinstall, noting that antivirus tools may not remove all persistence mechanisms and that some reports indicated the malware could disable Windows Defender.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
JDownloader published indicators of compromise and technical details for the malware delivered through the trojanized installers, including hashes, C2 URLs, registry keys, process names, decryption keys, and fake publisher names. The disclosure also described the payload as a layered Python-based RAT using multiple encryption schemes, dead-drop resolvers, and pythonw.exe for persistence and execution.
JDownloader brought its website back online after patching the exploited vulnerability and hardening the server. The developers advised anyone who executed the affected installers during the compromise window to consider a full operating system reinstall.
After investigating user reports, the JDownloader team confirmed the website compromise and took the server offline for emergency maintenance. The developers began investigating the incident and warned affected users that antivirus scans alone might not remove all persistence mechanisms.
A Reddit user and other community members flagged SmartScreen warnings, a suspicious publisher name, and other abnormal installer behavior, helping surface the compromise. Some reports indicated the malware could disable Windows Defender.
On 6 and 7 May, users downloading the Windows Alternative Installer or Linux shell script from JDownloader’s site could receive malware-laced files. Other distribution channels, including the main JDownloader.jar file, macOS installers, Winget, Flatpak, Snap, and in-app updates, were reported as unaffected.
Attackers abused an unpatched CMS vulnerability that allowed unauthenticated modification of access control lists, giving them the ability to edit JDownloader website content and replace official download URLs with malicious ones. The compromise affected the alternative download page and targeted Windows and Linux installer downloads.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
9 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcecybersecuritynews.com
Open sourcemalwarebytes.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcegendigital.com
Open sourcehackread.com
Open sourcejdownloader.org
Open sourceneowin.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Official Windows installers for **DAEMON Tools** were compromised in a supply chain attack, with malicious versions distributed from the vendor’s legitimate website beginning on April 8. Kaspersky said the trojanized installers affected **DAEMON Tools Lite** versions `12.5.0.2421` through `12.5.0.2434`, were signed with valid AVB Disc Soft certificates, and implanted a staged backdoor that contacted the typosquatted command-and-control domain `env-check.daemontools[.]cc`. TechCrunch reported that an independently downloaded installer also appeared to contain the backdoor when scanned, while Disc Soft said it was investigating and taking remediation steps. Researchers observed thousands of infection attempts across more than 100 countries, but the attackers appear to have selectively escalated only a small number of victims in **Russia, Belarus, and Thailand**. Follow-on activity targeted organizations in the **government, scientific, manufacturing, and retail** sectors and included additional payloads such as an information stealer, an in-memory backdoor using **RC4**, and a more advanced **QUIC RAT**. Kaspersky said Chinese-language artifacts in the malware suggest a Chinese-speaking threat actor may be involved, though attribution remains unconfirmed, and urged defenders to hunt for related hashes, suspicious DAEMON Tools process activity, and communications with `env-check.daemontools[.]cc` and `38.180.107[.]76`.
Jul 30, 2026
Researchers identified a campaign using at least **41 fake download websites** that impersonate popular games and Windows software, including **VLC**, **7-Zip**, **Paint.NET**, **Roblox**, **PUBG**, **Counter-Strike**, and **VMware**, to trick visitors into installing **Download Studio** instead of the product they selected. The pages display convincing product information and even show legitimate destination URLs on hover, but JavaScript intercepts the click and silently redirects users through an affiliate chain to a different installer. The delivered file analyzed by researchers was a roughly **73 MB** Windows executable signed by **Grand Media, TOV**, which installed Download Studio, enabled automatic updates, and in some cases registered torrent and magnet associations. Researchers said Download Studio was not confirmed as malware in this campaign, but warned that its updater was previously abused in 2020 to distribute the **FakeMBAM** backdoor and cryptocurrency miners, making the forced-installation tactic especially risky and underscoring the need to obtain software only from official vendor sites or trusted stores.
Aug 20, 2026
CPUID, the developer of **CPU-Z** and **HWMonitor**, confirmed that attackers compromised a backend website component and used a secondary API to replace legitimate download links with malware-laced installers for roughly six hours. The company said its signed software, source code, and build infrastructure were not breached, but the website intermittently served malicious files to users downloading or updating the Windows utilities. Reports from users and researchers, backed by VirusTotal detections, showed the poisoned downloads were delivered from CPUID’s trusted site, making the incident a software supply-chain attack. Analysis shared by researchers indicated the trojanized packages used a malicious `CRYPTBASE.dll` side-load technique, with payloads linked to an **Alien RAT** variant that executed much of its activity in memory via PowerShell, contacted command-and-control infrastructure, and attempted to steal browser credentials and session data from Chrome through the `IElevation` COM interface. Researchers also noted similarities to infrastructure seen in earlier campaigns targeting **FileZilla** users. CPUID took its site offline, removed the malicious links, fixed the abused API, and restored clean downloads, while users who downloaded **CPU-Z** or **HWMonitor** during the affected window were urged to assume compromise, reinstall Windows or otherwise thoroughly clean systems, log out of active sessions, and change passwords.
Jun 29, 2026