Fake 'The Odyssey' torrents install crypto wallet-stealing malware

Fake downloads of Christopher Nolan's The Odyssey have started spreading Lumma Stealer malware through files disguised as high-quality movie releases, putting crypto wallets, passwords, and browser sessions at risk.

Bitdefender reported on Aug. 6 that its researchers found malicious Windows executables using filenames designed to resemble pirated copies of the film, only days after its release.

Disguised as video files, the downloads use familiar torrent labels such as 1080p, WEBRip, Blu-ray, and H264 to make the listings appear authentic. Bitdefender identified filenames including "the odyssey 2160phd (2026) engsubs eztv.exe," "the odyssey 2026 1080p h264-djt.exe," and "the odyssey 2026 1080p webrip-lama.exe."

Rather than opening a movie, each .exe file launches software built to infect a Windows computer. Bitdefender said its security products prevented users from downloading or running the detected files, though the researchers warned that other filenames may also be circulating.

Attackers can make the disguise harder to spot by changing the executable's icon to resemble VLC Media Player or an ordinary video file. Windows installations hide known file extensions by default, Bitdefender noted, which means a user may see a movie-style name and VLC icon without noticing the .exe ending.

People searching torrent sites may also expect unusual filenames, compressed folders, or a bundled video player, giving the malicious file another layer of cover. The lure does not require a complex trick because the victim has already decided to download an unofficial copy from an unverified source, Bitdefender said.

Once executed, Lumma Stealer searches the infected computer for browser passwords, saved payment information, autofill records, remote desktop credentials, and cryptocurrency wallet data, according to the security firm.

The malware also collects browser authentication cookies. Stolen cookies can let an attacker take over an active account session even when the victim has enabled multi-factor authentication, since the criminal may reuse a session that has already passed the login check, Bitdefender warned.

Known as LummaC2, the malware is an information stealer developed in Russia and sold to other criminals as a service, according to Bitdefender and U.S. authorities. Its availability through underground markets allows buyers to run data-theft campaigns without building their own malware.

During its examination of the Odyssey files, Bitdefender observed attempts to contact command-and-control infrastructure associated with Lumma Stealer. Researchers identified the domains auditva[.]cyou, myroayy[.]cyou and logmabx[.]click, which the company said it had blocked for its customers.

Unlike some earlier versions, the samples found in the latest movie campaign did not use separate droppers or persistence tools, Bitdefender said. The operators instead appeared satisfied with collecting and sending available information during the initial execution.

Previous movie-based Lumma attacks used extra methods to avoid detection. Bitdefender found delayed execution when security software was present, encrypted payload delivery through AutoIt scripts, and other checks in a 2025 campaign built around fake copies of "Mission: Impossible – The Final Reckoning."

For U.S. crypto holders, LummaC2 has already drawn action from federal law enforcement. In May 2025, the Justice Department obtained warrants to seize five internet domains used by the malware's administrators, while Microsoft filed a separate civil case covering about 2,300 other domains tied to the operation.

Court documents cited by the department said the FBI had identified at least 1.7 million cases in which LummaC2 was used to steal information. Listed targets included browser records, email and bank login details, autofill data, and crypto seed phrases that could provide access to virtual asset wallets.

"Malware like LummaC2 is deployed to steal sensitive information such as user login credentials from millions of victims in order to facilitate a host of crimes, including fraudulent bank transfers and cryptocurrency theft," Matthew Galeotti, then-head of the Justice Department's Criminal Division, said in the announcement.

The federal operation seized two domains on May 19, 2025. After LummaC2 administrators told customers about three replacement domains the next day, U.S. authorities seized the new addresses as well, according to the department.

Alongside the seizures, the Cybersecurity and Infrastructure Security Agency and the FBI issued a technical advisory describing how LummaC2 enters computers and removes sensitive information. The Justice Department directed people who believe a device has been compromised to contact the FBI's Internet Crime Complaint Center or a local field office.

The appearance of new Lumma-linked domains in Bitdefender's 2026 findings indicates that malware campaigns using the family continued after the 2025 enforcement operation. Bitdefender did not provide a victim count, estimated crypto loss, or geographic breakdown for the Odyssey campaign.

Movie torrents are one part of a series of malware campaigns that package harmful code inside content, applications, or tools that users actively seek.

Earlier in August, crypto.news reported that Microsoft had found a fake CAPTCHA campaign using BNB Chain smart contracts to retrieve attack instructions. Microsoft said the operation targeted thousands of consumer and business devices each day and delivered several malware families, including Lumma Stealer.

Instead of downloading a movie, people caught in that campaign were instructed to open Windows Run, Terminal, or PowerShell and paste a command supplied by the attacker. Microsoft warned that successful infections could expose credentials, install remote-access tools, and create an entry point for ransomware.

Mobile users have faced a different form of wallet theft. In July, reports renewed attention around SparkKitty mobile malware, which Kaspersky had previously found inside iOS, Android, and third-party applications. The spyware collected images from phone galleries, where some users had stored screenshots of wallet recovery phrases, passwords, and QR codes.

Developer tools have also become a delivery route. Socket disclosed in May that the TrapDoor malware campaign involved at least 34 harmful packages and 384 connected versions across npm, PyPI, and Rust repositories. The packages targeted crypto and artificial intelligence developers while seeking wallet data, GitHub tokens, cloud credentials, and SSH keys, Socket said.

For the latest movie campaign, Bitdefender advised users to watch films through legitimate streaming services, avoid executables advertised as videos, and keep Windows and security software updated. The company also recommended enabling file extensions in Windows Explorer so an .exe file cannot appear to be an ordinary movie.