One Fake Movie Download Can Expose Passwords, Payments and Crypto Assets

Cybercriminals are weaponizing pirated downloads of the blockbuster theatrical release “The Odyssey (2026)” to deliver Lumma Stealer.

This prolific information-stealing malware quietly strips compromised systems of saved browser passwords, payment card details, and cryptocurrency wallets in a single execution.

Within days of “The Odyssey” becoming one of the year’s most anticipated theatrical hits, threat researchers observed malicious executables masquerading as high-quality WEBRip and Blu-ray torrents across file-sharing platforms.

Telemetry from Bitdefender indicates that users are actively downloading malicious Windows executables disguised as video files, carrying deceptive filenames such as:

• the odyssey 2160phd (2026) engsubs eztv.exe
• the odyssey 2026 1080p h264-djt.exe
• the odyssey 2026 1080p webrip-lama.exe

These files are not media downloads; they are compiled binaries designed to infect endpoints upon execution. This strategy mirrors a 2025 campaign that abused fake “Mission: Impossible The Final Reckoning” torrents, demonstrating how adversaries regularly re-skin their delivery mechanisms around trending box-office titles.

Understanding the full Lumma password stealer execution flow reveals how quickly an initial execution converts to system compromise.

Fake Movie Downloads Steal Passwords

Lumma Stealer (also tracked as LummaC2) is a Russian-developed Malware-as-a-Service (MaaS) family. Once executed, the payload harvests:

• Browser Data: Saved login credentials, autofill records, and active authentication cookies.
• Financial Details: Stored credit card information and banking portal sessions.
• Crypto Wallets: Local wallet files and browser extensions for MetaMask and related crypto platforms.
• System Credentials: Remote Desktop Protocol (RDP) login details and local system tokens.

Because Lumma prioritizes session cookies and active tokens, attackers can bypass multi-factor authentication (MFA) challenges to access online banking, email accounts, and cryptocurrency exchanges directly.

As detailed in research published by the operators continuously refine their MaaS toolkit with delayed execution timers and encrypted delivery scripts to defeat static detection. Adversaries frequently adapt these techniques across various infostealer malware strains to maximize credential extraction.

Bitdefender found that the campaign exploits user behavior on file-sharing sites, where hunters of leaked 1080p or 2160p releases expect compressed archives and unusual filenames. Victims often rationalize a .exe extension as a custom media player or codec installer.

Technical Vector	Attack Mechanism	Impact / Evasion Strategy
Default OS Settings	Hidden file extensions in Windows Explorer	Disguises .exe files with media player icons (e.g., VLC)
Data Exfiltration	Encrypted HTTP POST communication	Sends stolen credential bundles to active C2 servers
C2 Infrastructure	Rotating domains (auditva[.]cyou, logmabx[.]click)	Evades static IP and domain blocklists

Similar social-engineering patterns appear in clickfix attack tactics, where users are tricked into manually triggering malicious commands under the guise of technical troubleshooting.

To protect systems against movie-themed malware campaigns, security teams and individual users should enforce the following practices:

• Avoid Unofficial Downloads: Refrain from downloading pirated media from torrent trackers or unverified file-sharing portals.
• Enable File Extensions: Configure Windows File Explorer to display full file extensions so .exe files masquerading as videos are immediately visible.
• Never Run Video .exe Files: Treat any executable advertised as a movie, media codec, or video player as malicious software.
• Deploy Behavioral EDR: Utilize endpoint security tools equipped with real-time behavioral analysis to intercept zero-day Lumma samples before data exfiltration occurs.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.