www.it-connect.fr
iTorrents.org Compromised to Spread a Windows Malware Loader Instead of Movies
Hackers have compromised itorrents.org, a public torrent file repository used by many trackers, to spread a new malware dubbed MovieReaper. Here is what we know about this threat.
On September 17, 2026, Kaspersky researchers published a Securelist report on MovieReaper, a new modular malicious framework that had previously gone unnoticed. It all started with an infection campaign spotted in mid-August 2026, with one thing in common across all victims: using torrents to download files. However, it was not the trackers themselves that were hacked, but a source, namely itorrents.org. In fact, by compromising itorrents.org, the attackers took control of a public torrent file repository that many trackers rely on.
When a user follows a magnet link, this repository then returns another booby-trapped torrent file that downloads the malware loader. "This approach is particularly effective, as attackers can reach users across multiple trackers without having to compromise each platform individually", the report states. At the time the report was published, the repository was still compromised.
Torrent, tracker... how does it actually work? Think of the tracker as the conductor of a BitTorrent exchange. It does not store any movie or software: it keeps the list of machines sharing content and connects clients with one another. The torrent file itself contains only metadata (file names, piece layout, verification hashes, tracker addresses). In other words, the tracker is comparable to an indexing site that publishes these files and magnet links, as YggTorrent did.
This gives us the following attack flow:
To trap users, the attackers used movies as bait. That is not surprising; it is a good way to lure users who are fond of illegal downloads. In this case, the film The Odyssey was targeted, with the distribution of a malicious file named "the odyssey (2026) [1080p] [webrip] [5.1].exe". Kaspersky says the file names are deliberately very long, likely to hide the .exe extension, and that the executable uses the icon of a well-known application.
In general, The Odyssey seems to have been a prime target since its release on July 15, 2026. For example, last August, Bitdefender had already reported fake movie downloads used to distribute Lumma Stealer, a nasty infostealer.
MovieReaper: Four Stages and a Relay on the Solana Blockchain
Once the malicious file lands on a workstation, what happens next? Here are the 4 stages involved.
- The loader: this is the file downloaded by the victim. It chains together evasion techniques to stay under the radar of antivirus tools and sandboxes before fetching the rest of the code over HTTP from the deadhub[.]org domain, with IP address 193.23.118[.]155 as a fallback.
- The shellcode: it queries the Solana blockchain to retrieve the encrypted address of a second C2 server. Communications then continue over HTTPS.
- UAC bypass and persistence: a module loaded into memory bypasses UAC, copies the binary to
C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe, then relaunches the process. - The File Manager: this is the final module, and it exposes 21 commands: file download and upload, reading, deletion, moving, symbolic link creation, as well as image and file preview generation before exfiltration.
The use of Solana is no accident. The address of the second C2 is stored in a blockchain account, making the campaign more resilient to takedown operations. In short, blocking an IP address is not enough. Attackers can simply update the contents of the Solana account to point to a new server, and infected machines will find it on their own, without any way to neutralize the blockchain itself.
Several Hundred Victims, Including Organizations
This campaign appears to have claimed many victims. That is not surprising; downloading movies via torrents is widespread, as they say. For its part, Kaspersky identified several hundred victims in Europe (Spain, the Netherlands, Belgium, Germany, Finland), but also in Russia, Turkey, Japan, Kenya, and Colombia. At first glance, and we will not complain about it, France is not among the countries mentioned. That does not mean it was spared, but probably less so than other countries.
Kaspersky also says the campaign affects individuals as well as organizations, across different sectors (including government, IT, consulting, and agriculture). Using a work computer to download a movie because the office connection is fast is simply not okay.
Be aware that Kaspersky security tools now detect this threat as HEUR:Trojan.Win64.Agent.gen. On VirusTotal, I found a trace of this malware based on the hash, and it seems to be increasingly detected by many security tools. Finally, Kaspersky says that at the time the report was published, itorrents.org was still compromised. So we can only wonder how many trackers are still relying on it as I write these lines... Be careful.
