New Malware Campaign Targets Users via Popular Film Torrents, Experts Warn
A sophisticated new malware campaign has been uncovered by Kaspersky’s Global Research and Analysis Team (GReAT), with cybercriminals using torrent trackers to distribute malicious payloads disguised as popular films. The scheme has already infected hundreds of victims worldwide, including in Africa, Europe, Russia, and other countries.
The malware, which uses a loader capable of detecting antivirus sandboxes, allows it to evade detection and hinder further investigation if it’s being analyzed. Once active on a victim’s device, the malware deploys additional modules that expand its capabilities, enabling it to establish persistence, bypass User Account Control (UAC) to gain administrator privileges in Windows, and provide remote access to compromised machines.
To make matters worse, the malware uses the Solana blockchain to retrieve the address of its command-and-control server, giving attackers a more resilient way to maintain control over their infrastructure. This makes it harder for security teams to disrupt the campaign through blocking or takedown efforts.
The attack is notable for combining a common lure with sophisticated technical design, increasing the likelihood that unsuspecting users will download the malware. Kaspersky experts warn that even seemingly harmless entertainment content can serve as a vehicle for compromise, emphasizing the importance of caution when downloading files from unofficial sources.
Victims already identified include organizations operating in various sectors, including enterprise, government, IT, consulting, retail, transportation, and agriculture. The campaign has been active since at least mid-August and remains ongoing.
The use of torrent trackers to distribute malware is a concerning trend that highlights the need for users to be vigilant when downloading files from unofficial sources. “By disguising malware as torrents for popular films, the attackers increase the likelihood that unsuspecting users will download it,” says Konstantin Isakov, security expert at Kaspersky GReAT.
To stay safe, experts recommend that users:
* Be cautious with downloads and only install games and mods from official sources or reputable websites
* Use a strong security solution on all computers and mobile devices to warn about potential threats and prevent infection
* Never disable antivirus or security tools to download any files or software
Organizations are also advised to implement clear guidelines for the use of third-party software on work devices, use all-encompassing solutions that provide real-time protection and threat visibility, and provide their InfoSec professionals with in-depth visibility into cyberthreats targeting their organization. If your company lacks cybersecurity expertise, consider adopting managed security services from Kaspersky.
Source: Dark Reading — 2026-09-21