Loading story…
Scammers rapidly exploited interest in Christopher Nolan’s The Odyssey by launching cloned piracy sites that targeted users searching for unauthorized copies of the film. Researchers said the campaign used coordinated pages that copied torrent listings, artwork, and cast details, then displayed fake browser warnings claiming a missing component and urging visitors to click a “Fix It Now” prompt. Those prompts redirected victims into malvertising chains that could lead to fake browser extensions, scareware, and other malicious content.
A second lure offered what appeared to be a movie download but was actually a Windows executable disguised as a video file, using a movie-style filename, misleading metadata, and a VLC Media Player icon to look legitimate. The activity relied on social engineering rather than software exploits, with likely outcomes including Trojans, infostealers, loaders, and potentially ransomware if users ran the file. Researchers warned that a supposed movie ending in .exe is a strong sign of malware and advised affected users to scan systems, disconnect compromised devices, and change passwords from a trusted device.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Malwarebytes reported a coordinated scam campaign exploiting interest in Christopher Nolan's film The Odyssey within hours of its theatrical release. The campaign used cloned piracy sites with fake browser warnings and fake movie downloads that were actually Windows executables disguised as video files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securitymagazine.com
Open sourcemalwarebytes.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are distributing **Lumma Stealer** through fake pirated downloads of Christopher Nolan’s *The Odyssey*, disguising malicious executables as movie files and in some cases giving them VLC-style icons. Bitdefender reported that the files rely in part on Windows hiding `.exe` extensions by default, increasing the chance that users will mistake them for legitimate video downloads and launch them. Once executed, Lumma Stealer can harvest browser passwords, cookies, payment card data, cryptocurrency wallet information, autofill records, and remote desktop credentials. Researchers also observed attempted communications with Lumma-linked command-and-control domains including `auditva[.]cyou`, `myroayy[.]cyou`, and `logmabx[.]click`. Lumma is widely tracked as a Russian-developed malware-as-a-service infostealer, enabling multiple criminal operators to reuse the malware in campaigns built around popular lures.
Aug 10, 2026
Researchers reported a malware campaign delivering a modified **SilentCryptoMiner** alongside a remote access trojan through illegal movie, TV, and digital library websites that pushed fake video player plugin updates. The infection chain used a ZIP archive containing a legitimate executable and a malicious DLL for **DLL side-loading**, then triggered stack-overflow-based ROP decryption and reflective loading to deploy the main module, a watchdog component, the RAT, and CPU/GPU miners. The activity appears to extend operations seen since at least 2022, with refreshed infrastructure and delivery sites but largely unchanged archive structure and execution logic. The malware used **DNS tunneling** and date-based domain generation for execution gating and command-and-control, disabled security and power-saving features when it gained elevated privileges, and established persistence through a fake `GoogleUpdateTaskMachineQC` service; researchers said the campaign had substantial exposure because the affected piracy-related sites drew roughly **40 million visits** in April 2026.
Jun 29, 2026
Researchers reported multiple campaigns using fake download and streaming sites to compromise users with remote access tools, malware, and proxyware. Kaspersky found more than 90 spoofed domains in 10 languages promoting bogus Windows software downloads through search engine optimization; the delivered archives used DLL sideloading to install the expected application alongside **ScreenConnect**, then deployed **AsyncRAT** for persistent access. In one investigated case, the attackers altered Microsoft Defender exclusions, disabled User Account Control, and used process hollowing into `RegAsm.exe` to launch the payload, creating risk for both consumers and enterprise networks because remote administration tools are often allowlisted and may run with elevated privileges. A parallel set of campaigns abused demand for free media and utilities to lure victims into installing unwanted software that can expose systems and internet connections to criminal use. Researchers tracking World Cup-themed piracy sites found rotating mirror domains, typosquatting, and cloud-hosted pages pushing fake **Stremio** installers, VPN-themed lures, and affiliate-style downloads tied to malware, phishing, and scams. Separate analysis of a fake **7-Zip** installer showed a Go-based backdoor that converted infected Windows hosts into residential proxy nodes, while broader threat reporting warned that free VPNs, streaming apps, browser extensions, and cheap IoT products are increasingly used to build residential proxy networks that criminals exploit for fraud, scraping, account abuse, and evasion.
Jul 12, 2026