JDownloader site hacked to replace installers with Python RAT malware
2026-05-10T13:23:30Z•f50b632e4b5f20667e4a43d8a2864eaa316390c831e1d2fb64baf74a7b513d53
clickfixdata-breachdirty-fragepmmextortiongeforce-nowhuggingfaceinfostealerivantijdownloaderlinux-zero-daylocal-privilege-escalationnvidiapcpjackphishing','cisa','patching','zarapython-ratransomhouserceshinyhunterssource-code-leaksupply-chaintclbankervidarwebsite-compromisezero-day
What happened
Multiple active incidents and campaigns reported: the JDownloader website was compromised to deliver malicious Windows and Linux installers (Windows payload is a Python-based RAT); a fake OpenAI repo on Hugging Face distributed an infostealer; NVIDIA confirmed a GeForce NOW user-data breach affecting Armenian users; Trellix source-code access was claimed by RansomHouse; Ivanti Endpoint Manager Mobile (EPMM) has a high-severity RCE zero-day actively exploited (CISA ordered rapid patching); a new Linux local-privilege “Dirty Frag” zero-day gives root on major distros; ShinyHunters carried out a广
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- f50b632e4b5f20667e4a43d8a2864eaa316390c831e1d2fb64baf74a7b513d53
- Enrichment time
- 2026-05-10T13:23:30Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.