Loading story…
Cybercriminals are leveraging the popularity of a new Leonardo DiCaprio film, 'One Battle After Another,' to distribute the Agent Tesla remote access trojan (RAT) through malicious movie torrents. Victims searching for the film online are tricked into downloading a folder containing seemingly legitimate files, including a shortcut file (CD.lnk) and a subtitle file (Part2.subtitles.srt). When the shortcut is executed, it triggers a multi-stage attack that uses hidden batch code within specific lines of the subtitle file to launch PowerShell scripts, ultimately installing Agent Tesla on the victim's Windows system. The attack is designed to run entirely in memory, using legitimate Windows tools such as CMD, PowerShell, and Task Scheduler to evade detection by traditional security software.
Bitdefender researchers identified this campaign after observing a spike in detections linked to the fake movie torrent. The malware deployment process involves multiple layers of encryption and code obfuscation, with malicious scripts embedded in files that otherwise appear harmless. Once installed, Agent Tesla grants attackers full remote access to the infected device, enabling the theft of personal and financial information. The campaign has already impacted thousands of users, highlighting the ongoing risks associated with downloading pirated content from untrusted sources.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Bitdefender observed that the same or similar torrent-based lures were also used in related campaigns delivering other malware, including Lumma Stealer. This showed the technique was part of a broader pattern of abusing pirated media downloads for malware distribution.
Attackers distributed a fake movie torrent containing a malicious LNK file and subtitle files with hidden PowerShell code that launched a multi-stage infection chain. The payload was Agent Tesla, deployed in memory using legitimate Windows tools, scheduled tasks, and concealed files to evade detection and steal credentials.
Bitdefender researchers uncovered a malware campaign abusing fake torrents for Leonardo DiCaprio’s film 'One Battle After Another' to infect users. The campaign was identified after researchers observed a spike in related detections and found the torrent had attracted thousands of seeders and leechers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A phishing campaign is distributing **Agent Tesla** through Spanish-language business emails that impersonate purchase orders and invoices, targeting organizations across Latin America and Spain. Broadcom reported that the attack delivers a RAR attachment disguised as a PDF, then executes a multi-stage chain involving a JScript loader, PowerShell downloaders, an in-memory .NET loader, and a final **Agent Tesla** payload that runs largely in memory. The campaign uses obfuscation, masquerading, urgency-themed messaging, and an **AMSI bypass** to evade detection while minimizing disk artifacts. The malware is designed to steal credentials, system information, and other sensitive data, then exfiltrate it over encrypted HTTP(S) channels. The activity aligns with earlier large-scale Agent Tesla spam operations that used polished corporate-themed lures and impersonated legitimate companies to infect business users at scale, with especially high impact in Mexico and Spain. Across observed campaigns, Agent Tesla variants have targeted credentials stored in browsers, email clients, FTP and VPN tools, remote access software, and messaging applications, while also supporting screenshot capture, keylogging, and clipboard theft.
Aug 15, 2026
**Agent Tesla** continued to appear in phishing-led intrusion chains that used malicious Office documents, ISO attachments, JavaScript, VBScript, and NSIS-based loaders to infect Windows systems and deploy the .NET infostealer in memory. Multiple reports described delivery through macro-enabled purchase-order lures, DHL-themed malspam, and droppers that abused `certutil.exe`, `mshta`, and spoofed or cybersquatted infrastructure such as `diodetechs[.]com`. Researchers also documented layered packing and concealment methods including oversized padded executables, embedded bitmap and PNG resources, reversed payloads, XOR and compression routines, and steganography that hid intermediate DLLs or final payloads inside image files before injection into processes such as `MSBuild.exe`. Once installed, Agent Tesla established persistence through **Run registry keys**, scheduled tasks, Startup-folder entries, or dropped copies under `%APPDATA%`, then harvested credentials and surveillance data from browsers, Outlook and other email clients, FTP and VPN software, cookies, clipboard contents, keystrokes, screenshots, and in some cases cryptocurrency wallet addresses. Stolen data was exfiltrated over **SMTP, FTP, HTTP, and sometimes Tor-backed channels**, with some samples checking `agenttesla[.]com` for updates or using attacker mailboxes embedded in configuration data. Researchers also observed variants paired with additional malware, including a clipboard hijacker and **Crysis/Dharma ransomware**, underscoring how this long-running malware-as-a-service family combines commodity phishing delivery with evolving obfuscation and post-infection tradecraft.
Aug 15, 2026
Threat actors have leveraged popular creative content platforms and multimedia files to distribute infostealer malware to unsuspecting users. In one case, attackers uploaded free 3D model files containing malicious Python scripts to the CGTrader marketplace for use with the open-source Blender software. If users had Blender's "Auto Run Python Scripts" feature enabled, simply opening the .blend file would execute the embedded script, which then connected to a remote server to download a malware loader, ultimately infecting the system with the StealC V2 infostealer. This attack highlights the risks associated with open-source tools that allow automation and the lack of security controls on user-generated content marketplaces. In a separate but thematically similar incident, Bitdefender researchers discovered a torrent file for the movie "One Battle After Another" that was used to deliver the Agent Tesla malware. The attack chain began when users launched a shortcut file included in the torrent, which triggered a series of PowerShell scripts hidden within a subtitle file. These scripts extracted and executed additional payloads from other files in the torrent, ultimately running the Agent Tesla infostealer entirely in memory to evade detection. Both incidents demonstrate the increasing sophistication of malware delivery methods that exploit trusted creative and entertainment platforms, targeting users through seemingly legitimate files and leveraging features like script automation and file embedding.
Jun 29, 2026