Cybersecurity firm Bitdefender has discovered the circulation of a pirated file of the movie ‘The Odyssey’ infected with Lumma Stealer malware. This download link began spreading on the internet just days after the film’s premiere, targeting seekers of free entertainment.
To lure victims, the attacker group disguised their file as a full movie leak. The file was distributed with a name indicating a WEBRip format and a high-resolution Blu-ray recording, creating the impression that the content was ready to watch.
How the Icon Trick Works
Behind the appearance promising a clear resolution, the downloaded file does not contain any video content at all. Analysis revealed that its contents are purely a Windows executable with a .exe extension. Instead of playing movie scenes when clicked, the file immediately runs malicious code that infects the computer from within.
This tactic claims victims by exploiting system settings. By default, the Windows operating system hides file extensions behind their names, making the .exe text invisible to average users. To enhance the camouflage, attackers attached an icon resembling the VLC media player logo. Victims who click the icon think they are opening a video player, while their own hands are actually granting entry to the stealer program.
Once its code is implanted in the system, Lumma Stealer immediately goes to work draining digital assets. Its core targets include crypto wallet contents, remote desktop credentials, stored payment card details, autofill data, and browser password lists. Additional security layers are also bypassed, as this program also grabs authentication cookies containing Multi-Factor Authentication (MFA) login sessions.
Responding to this threat, Bitdefender blocked access to the download links and flagged a series of command-and-control domains managing the intrusion operation.
Pop Culture Trend Traps
Attack activities leveraging the popularity of major film releases are not a new approach. This piracy-based infection practice repeats the track record of a similar campaign in 2025. At that time, attackers set traps using the filename ‘Mission: Impossible - The Final Reckoning’ to compromise targets through an identical scheme.
Disguising threats into the form of entertainment and daily routines continues to be a rampant pattern. In the wider digital ecosystem, similar incidents show the diversity of scams. The pattern spans from fake CAPTCHA traps on the BNB Chain network, the SparkKitty campaign operations on mobile device apps, anime character wallpapers to trap gamers on Steam, to Python libraries in public repositories that were intentionally poisoned to read data from developers’ computers.
The initial intent of seeking alternative viewing can now result in losses from lost crypto balances.
Reported from Decrypt.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
