We just found out that our primary hosting site fosshub.com has been attacked by some hackers who modified the installation files of popular software to distribute viruses (more information available for example here)
Good news first: The JabRef downloads are currently NOT affected by this attack.
I.e., if you have recently downloaded JabRef from fosshub.com and the installation has succeeded everything should be fine.
However, as a precaution we have removed the link to fosshub.com from our website and now link directly to the GitHub release page: https://github.com/JabRef/jabref/releases/tag/v3.5
Another safe download mirror can be found here: https://sourceforge.net/projects/jabref/files/v3.5/
In order to be sure that an already downloaded file is not compromised you can use the following hashes:
JabRef Windows Installer (64 bit) - 25.13 MB | version: 3.5
JabRef Platform independent runnable JAR - 23.83 MB | version: 3.5
JabRef Mac OS X - 24.46 MB | version: 3.5
JabRef Windows Installer (32 bit) - 25.04 MB | version: 3.5
Or you can upload the file at https://www.virustotal.com where it is checked by more than 50 different virus scanning tools.