1-Month:
Premium $19.99 (up from $17.99) Extra $16.99 (up from $14.99) Essential $10.99 (up from $9.99) 3-Months:
Premium $54.99 (up from $49.99) Extra $43.99 (up from $39.99) Essential $27.99 (up from $24.99)
Dev's response in the thread:
Update 1: I can confirm that the site has been compromised, have taken it down for further investigation
Update 2:(20:12 - 07.05.2026 GMT+2) The attack has modified alternative download page and exchanged links&details. The bad ones are missing digital singnature and as such smartscreen will block/warn the exeuction of it. The correct ones are okay and having proper digital signature in place.
Update 3:(20:25 - 07.05.2026 GMT+2) As there has been a question about flatpak...flatpak/winget infra is not ours but downloads to our infra are secured by sha256 and I just checked the flatpak/winget manifest and no changes, so they are good. Snap package comes bundled with its own JDownloader.jar (not being downloaded from our infra), also no changes, also good.
Update 4:(20:33 -07.05.2026 GMT+2) As there has been a question about updates. Those are not compromised, different infra, protected by end-2-end digital signature.
Update 5:(20:39 - 07.05.2026 GMT+2): State of linked installers:
Compromised: all alternative installer links replaced , no digital signature -> getting blocked by smartscreen
Compromised: linux shell installer link replaced , contains malicious shell code
NOT compromised: all macos, valid digital signature. JDownloader.jar, correct link/file. 3rd party packages, see Update 3
Update 6:(21:18 - 07.05.2026 GMT+2) When?
Website with the alternative installers has been compromised on Wed May 06 2026 00:01:09 GMT+0000
Before that, the attacker did experiment on another dummy site on Tue May 05 2026 23:55:37 GMT+0000
Update 7:(22:03 -07.05.2026 GMT+2) As there has been question about 3rd party docker images. some docker images pull JDownloader.jar from different infra, not affected. Only website has been compromised.
Update 8:(23:09 -07.05.2026 GMT+2) Comparision/Diff of all files with offsite(rsnapshot in pull mode) backup has shown that only the two sites mentioned in update 6 have been edited/compromised.
The attack was about editing the website and replacing the alternative installer links with compromised ones, smartscreen does warn about execution of them due to missing digital signature.
Update 9:(00:11 -08.05.2026 GMT+2) Question was if we have analyized the actual compromised installers yet, no and to be honest, this is little out of our scope. As asked for several times, I've collected and uploaded all the compromised installers, you can find them here https://transfer.it/t/IW7ZZUt3xZjb Any help is welcome for further analysis of what those compromised installers were doing/trying to do.
Update 10:(01:32 -08.05.2026 GMT+2) Restored the two modified websites/files from backups and reviewing server configuration, putting website into read only mode
Update 11:(01:58 -08.05.2026 GMT+2) website will be kept shutdown until later today, I'm off to bed now,need some rest, cya later
Update 12:(02:59 -08.05.2026 GMT+2) attack vector is known, used unpatched security bug to change acl without being authenticated and change edit rights on specified website to all and then replaced content with compromised links. logs show/confirm that testing was done on insignificant subsite, then replaced website of alternative installers, see update 6 and 8
Update 13:(03:06 -08.05.2026 GMT+2) website will be kept shutdown until later today, then patches applied, config hardening, I'm off to bed now,need some rest, cya later
Update 14:(04:10 -08.05.2026 GMT+2) still answering questions and comments
Update 15:(08:43 -08.05.2026 GMT+2) back, continue with recovery/hardening
Update 16:(08:59 -08.05.2026 GMT+2) replying/commenting, question came up multiple times, we don't know what the compromised installer is doing and its potential risk also depends if you have started it elevated or non elevated.