Illegally downloading the latest Oscar contender might feel like beating the system. But when the malware kicks in, as Morpheus once said, “Welcome to the real world.” Lurking in the shadows lies a common enemy of both the illegal streamer and the movie studios.

As with Reddit, many torrenting websites are full of regular people trading files, helping each other save money. There is an increasing argument that you are more likely to find a closer community of like-minded souls online than in the increasingly polarized streets where you live.

However, just like in real life, there will be people looking to exploit kindness as a weakness. While many users are searching online for how to access the latest Oscar-nominated movies and blockbuster hits, criminals will be looking for easy pickings from trending searches, or in movie speak, “Some men just want to watch the world burn.”

Having content scattered across multiple streaming platforms has created friction and fueled piracy's resurgence as audiences share their personal supervillain origin stories online.

One Battle After Another: The Oscar season torrent tttack that weaponized subtitles

The same way the excitement of awards season creates opportunities for pirates, it's also a big win for hackers looking to capitalize on those same ecosystems.

One example of this would be a torrent poisoning attack that offered unsuspecting users a free download of the movie "One Battle After Another". Included were a subtitle file and a Windows shortcut; together, these delivered a remote access trojan (RAT) through a multi-stage PowerShell chain.

The malicious torrent came as a folder with several seemingly normal files: a large "movie" file (One Battle After Another.m2ts), a subtitle file (Part2.subtitles.srt), some images (Photo.jpg, Cover.jpg), and a shortcut (CD.lnk) that looked like a launcher for the film.

If you look beyond the tech speak, victims were socially engineered to double‑click the shortcut instead of opening the video directly, which was the only action needed to trigger malware execution.

As analyzed by Bitdefender, there are five stages of this attack. In the first stage, a script extracts the .m2ts file as an archive, then creates a hidden scheduled task ("RealtekDiagnostics") that will continually run a batch file. In the second stage, the batch file will decode additional payloads from the embedded images. Finally, the third stage will add additional scripts to the Microsoft Diagnostics folder.

Later stages ensure specific Windows cache directories exist, expand more hidden content from Cover.jpg, perform checks for Windows Defender, install Go if needed, and finally reconstruct and load Agent Tesla directly into memory (fileless style) to make detection harder.

Who should you trust in the war over piracy, risk, and consumer safety?

A report on consumer risk from piracy in Southeast Asia revealed that P2P networks carry up to 65 times the risk of legitimate sites, making them the most dangerous form of piracy.

The report also revealed that streaming piracy services are up to 52 times riskier than legitimate platforms. Elsewhere, scam piracy portals come close behind, with up to 49 times the risk, showing how audiences are naively transported into fraud infrastructure. But, as with anything online, you should question everything you read, even when it's evidence served up by the so-called good guys.

The Motion Picture Association funded the report, which uses a relative-risk method with a continuity correction, setting zero detections on control sites to 1 for comparison. All of which leaves you thinking that all sides with skin in the game are attempting to sway audiences to their side, whether legitimate or illegal.

How Malvertising on piracy sites infected nearly one million devices

Malware on piracy sites does not always hide inside the movie or the download file. Increasingly, the danger actually comes from the advertising ecosystem that surrounds those sites. This technique is known as Malvertising, in which attackers place malicious code within online ads or redirect chains rather than within the files users expect to download.

Most of the time, when an end user visits a website, the site quietly redirects the user's browser to several intermediary sites that can serve malware, phishing pages, fake system alerts, etc. This allows an attacker to infect a device using the Malware delivery vehicle (the advertisement) without the end user ever downloading anything from the website they originally visited.

A malvertising campaign was discovered in December 2024 by Microsoft Threat Intelligence, which ultimately infected nearly a million devices. The first part of this malvertising campaign originated with illegal video streaming websites displaying malicious advertisements.

According to Microsoft, two domains associated with pirated video streams and movie downloads: movies7[.]net and 0123movie[.]art directed thousands of visitors to these domains to other scam pages, including GitHub, Discord, and Dropbox. Once there, the malware's payloads were waiting.

Attackers used signed software certificates to sign their malware, then staged their payloads to appear as legitimate software, making it seem like a normal install process. The next stage of the malware would be delivered once the legitimate-looking install process had completed and would be able to steal system data, monitor browser usage in Chrome, Firefox, and Edge, and install additional malware.

If you want to illegally view movies, use the same level of caution when accessing video streams as if they were hostile networks. In addition to running high-end ad-blocking software, always create a new browser profile with no login credentials and only the absolute minimum number of extensions in order to dedicate one browser to the viewing of pirated content alone. Also, enable script/cookie blocking at maximum settings.

Also, never download any HD Player, Codec, or Browser Extension offered by the website. Most of the time, an attacker will distribute malware through this type of prompt.

If you can, always choose to access a video stream directly instead of downloading it from a File-Hosting Link on the webpage. The reason is that each additional redirect (mirror, archive, or shortened URL) increases the amount of attack surface.

Always be cautious about new torrent communities or uploaders' reputations, especially with new uploader accounts or unusually popular torrent uploads. Only download video files and do not use torrent downloads that include a player, crack, installer, shortcut, or script files. Attackers commonly use these types of items to distribute malware.

The torrent subculture and the security reality

There is a subculture in the torrent world that sees itself as anti‑corporate, pro‑sharing, and "helping people save money," and many index sites and private trackers enforce quite strict release and quality rules.

Despite their ideological ethos, those same communities sit atop open protocols and high‑traffic sites that are extremely attractive to financially motivated bad actors, so, from a security standpoint, the landscape looks "infested," even if the median user's intent is benign.

Criminal gangs target pirated films to exploit them and use them in their own criminal activities. For threat modeling purposes, consider all public piracy networks (torrents & streaming) as an untrusted, hostile environment that just so happens to provide media as a side effect, not as a relatively safe community frequented by a few 'bad apples'.

In the end, piracy ecosystems may promise free entertainment, but the risks are real. And if malware is the price of admission, you have to ask yourself: “Are you not entertained?”

---

Unlock more exclusive Cybernews content on YouTube.