A blockbuster just hit theaters. Someone finds a "clean" 2160p torrent, downloads it, double-clicks, and waits for VLC to open.
Nothing plays. No error. But a hidden .exe just reached out to a C2 server, siphoned every saved browser password, hijacked active login session cookies, and hunted for a MetaMask wallet file. By Monday, that "movie fan" is disputing fraud charges and resetting every account.
This is the exact playbook researchers observed after a major 2026 blockbuster release, where threat actors weaponized the film's popularity to distribute Lumma Stealer — a Malware-as-a-Service infostealer.
What makes this campaign notable for defenders:
- Filenames mimic real scene-group tagging to avoid suspicion
- Windows hides file extensions by default, so the binary shows just a video icon
- Lumma prioritizes session cookies over passwords — bypassing MFA by replaying an authenticated session
- Loader chains decrypt and run the payload in memory, reducing on-disk artifacts
- Exfiltration via encrypted HTTP POST to rotating C2 domains, defeating static blocklisting
Full attack chain, real IOCs, PowerShell detection commands, a registry fix for visible extensions, and IR priorities:
https://www.xpert4cyber.com/2026/08/fake-movie-download-steals-passwords.html
If you're building detections or writing EDR rules — worth the read.
Top comments (0)