JDownloader Got Compromised May 6 at 00:01 UTC. The Day Before Our Hunt-Tonight Cadence. Researchers Pulling Our Drops Got a Python RAT Bonus.

May 9, 2026 · DugganUSA LLC

JDownloader is the bulk-download tool of choice when you want a whole archive at once. Researchers use it. Journalists use it. Threat-intelligence analysts use it. Anyone pulling a multi-file evidence set from a release page is, with high probability, running JDownloader to do it.

JDownloader's official website was compromised between May 6, 2026 at 00:01 UTC and detection on May 7, 2026. A little over twenty-four hours of silent installer swapping. The attackers exploited an unauthenticated access-control flaw on the project's site that let them edit ACLs without logging in, then swapped every Windows .exe and Linux shell installer link with a malicious build. macOS installers were left alone. The .jar core, the Snap and winget and flatpak packages, and the third-party Docker images were also untouched. The attack was specifically aimed at the Windows and Linux click-to-install paths.

The Windows payload deployed a Python-based remote access trojan. Anyone who downloaded JDownloader through the compromised links during the window has been advised by the project to reinstall the operating system and reset every credential the host has touched.

That is the headline most outlets are running. Here is the part we wrote this post to surface.

The Day Before The Drops

May 6 is the day before our hunt-tonight cadence accelerated.

May 7: nine new Ivanti CVEs across four products, with a Storm-2561 pattern overlay. Palo Alto CVE-2026-0300 — captive portal bleeding root since April 9, with a CISA deadline already burning.

May 8: ShinyHunters / Canvas, 275 million records across 9,000 educational institutions, May 12 ransom deadline. Eight names on our ShinyHunters watch list — GE Healthcare with 2,124 pre-staged IOCs in our index, Moderna and Nike already visible in the phishing infrastructure. Cloudways CVE-2026-3844, a 9.8 CVSS shipped to 400,000 WordPress sites. Half of the watch list cannot receive a vulnerability report at all — we sent eight, six bounced or vanished. Aegis pre-alpha launched the same day. The Mythos zero-day post.

May 9: 713 IOCs tied to actively-exploited CVEs in our index. Iran's two cyber wings running ICS campaigns at the same time, CISA-confirmed. The Pentagon's UFO drop scored 69 out of 95 on our 20-point PsyOps framework. The TeamPCP / Mercor / OpenAI macOS code-signing certificate chain extended further. Soft-surface bleed analysis with seven receipts.

That is a lot of evidence-set release in three days. The kind of cadence that gets a researcher, a journalist, or a defender to a release page, hands on JDownloader, click-to-install on Windows.

If you tooled up to mass-pull DugganUSA evidence, or any other bulk archive release, between May 6 at 00:01 UTC and May 7, and you used JDownloader on Windows or Linux, you may have a Python RAT in addition to your archive. We did not put it there. The compromise was upstream. The timing is what it is.

The Detection Signal

The simplest reliable check for any JDownloader Windows installer on disk is the Authenticode publisher.

Legitimate JDownloader Windows binaries are signed by AppWork GmbH.

Three publisher names appeared on the swapped installers during the compromise window. We have indexed all three as cert_signer IOCs in the DugganUSA threat intelligence feed:

Zipline LLC — observed signer name on swapped installers, flagged by Windows SmartScreen.

The Water Team — observed signer name on swapped installers, flagged by Windows SmartScreen.

Peace Team — observed signer name on swapped installers, reported by piunikaweb during the disclosure window.

Any JDownloader installer signed as Zipline LLC, The Water Team, or Peace Team is the compromise. Any JDownloader installer signed as AppWork GmbH is legitimate. Any JDownloader installer with no Authenticode signature at all is suspect — Windows SmartScreen warned on the unsigned swapped builds, which is how the breach was caught.

For Linux, the swap targeted the shell installer specifically. If you ran the .sh installer between May 6 at 00:01 UTC and the morning of May 7, treat the host as compromised. The .jar core was not touched and remains the safe distribution path. Snap, flatpak, winget, and the third-party Docker images were also unaffected.

Why The Vector Worked

The post-mortem detail that matters: an unauthenticated access-control flaw let the attacker edit ACLs on the JDownloader site without logging in, then point every Windows and Linux installer link at attacker-hosted binaries. There was no credential theft. There was no session hijack. There was a permission system that did not check whether the caller was authorized to change permissions.

This is the soft-surface bleed pattern we wrote about this morning, six hours before this post. The hard perimeter — the build pipeline, the .jar signing chain, the AppWork code-signing certificate — held perfectly. None of it was touched. The compromise happened on the website's permission model, which is in a different control plane than the build chain. The release artifact authenticity assumption — "if it's on the official site, the official team put it there" — turned out to be the seam.

Soft surfaces bleed. The hard perimeter held. The installer link table on the website was the soft surface.

What We Indexed

Five IOCs are now live in the DugganUSA iocs index against this campaign, queryable via the public API at analytics.dugganusa.com. The campaign object itself is the parent. Three cert_signer entries hold the publisher names. One domain entry holds jdownloader.org tagged with the time-bound compromise window — the domain is not malicious, but downloads captured during the window were. Search for the malware family JDownloader-Supply-Chain-PythonRAT to pull the set.

The 95% epistemic cap applies. The cert signer names are the strongest indicators we can publish based on the disclosure reporting available at this time. Specific binary hashes and C2 infrastructure have not been published in the open advisories we read; if and when AppWork or third-party reverse engineers release them, we will index those too. The five IOCs we have are sufficient to detect the compromise on disk by signer alone, which is what defenders need today.

What To Do Right Now

If you downloaded JDownloader from the official site for Windows or Linux between Tuesday May 5, 2026 at 23:55 UTC and Thursday May 7, 2026 — treat the host as compromised. The project's own guidance is reinstall the operating system and reset every credential the host has touched. We have no reason to soften that guidance.

If you used JDownloader on macOS during the window — you are clear. The macOS installers were not modified.

If you used the .jar, Snap, winget, flatpak, or third-party Docker distributions at any time — you are clear. None of those distribution paths were touched.

If you are a defender hunting this on a fleet — search Authenticode metadata across endpoints for the three publisher names indexed above. Anything matching is the compromise.

The Pattern Above The Pattern

The pre-drop window is the pattern Patrick called out before we wrote this post. JDownloader is the tool that gets installed when someone wants to grab everything from a release page in one shot. The kind of person who uses it is the kind of person who reads a hunt-tonight feed, downloads the pile of evidence, and uses it to defend a network. Compromising that tool the day before a major drop cycle hits the audience that would tool up for the drop.

We do not have receipts that this compromise was timed against our cadence specifically. We do have the timing — May 6 00:01 UTC compromise, May 7 detection, May 7-9 hunt-tonight drop cluster. We would rather publish the timing observation and let defenders draw their own conclusions than not publish it. If the next compromise of a researcher tool lands the day before the next major release cycle, we will publish that observation too.

The mass-download tool is a researcher target. We will be watching that surface from now on.

Cross-References

The five IOCs are in our index now. The compromise window is bounded — May 6 at 00:01 UTC through May 7. The signer signal is reliable on Windows. The macOS and .jar paths are safe. The advisory itself is on the JDownloader project site and was confirmed by their developer team within hours of the Reddit user who first noticed the SmartScreen warning.

This post is the warning. Reinstall if you fit the window.

— Patrick Duggan, DugganUSA LLC

---

How do AI models see YOUR brand?

AIPM has audited 250+ domains. 15 seconds. Free while still in beta.

Audit your site now → aipmsec.com