Movie torrents are being used to deliver a new Windows malware framework called MovieReaper. Attackers have poisoned torrent downloads for popular films, turning a routine search for entertainment into a route for remote access and data theft.

The campaign has reached users and organizations across several countries. Victims who use a magnet link may receive a malicious torrent file instead of the movie they expected.

The altered file downloads a loader disguised as a media release, often with a long name designed to hide its executable extension. Once opened, it begins a staged compromise that largely runs in memory.

Analysts linked the activity to compromised storage used by torrent trackers rather than a breach of every tracker itself. That distinction let the operators reach multiple services through one poisoned repository.

Securelist said in a report shared with Cyber Security News (CSN) that investigators identified several hundred victims. Observed infections span Europe, Asia, and Africa, affecting private users as well as organizations in government, IT, retail, transport, consulting, and agriculture.

The breadth of those targets shows why poisoned downloads remain a problem: a single compromised distribution point can expose people who never visit the same torrent website.

Some infections were found in Russia, Türkiye, Japan, Kenya, Uganda, Colombia, Spain, the Netherlands, Belgium, and Germany during the first reported campaign wave.

Hackers Poison Movie Torrents With MovieReaper Malware

The first-stage loader has appeared under names such as “the odyssey (2026) [1080p] [webrip] [5.1].exe,” while sharing the same MD5 hash across downloads.

It uses a familiar application icon and an oversized filename to make the final .exe less obvious. This social engineering relies on victims launching what looks like video content.

Before contacting its operators, the loader performs checks intended to frustrate automated analysis. It avoids common Windows calls, uses a vectored exception handler, and executes the next component in memory.

Readers tracking similar evasive behavior can compare Windows UAC bypass technique, where trusted-looking Windows paths and elevation weaknesses were also used to reduce suspicion.

MovieReaper then reaches a first-stage server for shellcode, using a domain and a fallback IP address. The payload fetches extra code in fragments that resemble harmless cloud-service image paths.

Infection chain (Source - Securelist) — Infection chain (Source – Securelist)

It later installs itself under a Windows telemetry-looking location, bypasses User Account Control, and restarts to preserve access after the victim logs back in.

The final module gives the operators broad control over files, including the ability to read, upload, download, rename, move, and delete them.

It can also create previews and thumbnails before taking content, helping attackers choose valuable files. That modular design means further capabilities can be delivered only when an operator decides they are needed.

Solana-Based C2 Strengthens Resilience

The campaign’s most unusual feature is its use of the Solana blockchain to locate a later command-and-control server. The shellcode queries a specific account through Solana’s getAccountInfo endpoint, then decodes an encrypted address stored in the returned data.

This makes the communication path harder to disrupt than a conventional server list. Blockchain-based control does not make the malware invisible, but it can complicate takedowns because the attacker can update destination data without depending on one ordinary website.

A related Developer-targeting Glassworm malware campaign likewise used Solana to distribute instructions, illustrating how criminals are adapting public blockchain services for operational resilience.

MovieReaper’s second-stage component uses HTTPS with a pinned certificate and can load add-on modules directly into memory. Researchers say the actor’s activity dates to October 2025 and has evolved to make the loader harder to detect.

The PHANTOMPULSE blockchain C2 analysis similarly shows how memory execution, privilege bypasses, and decentralized control can reinforce one another.

Defenders should block the indicators in the table, investigate systems with unusual torrent downloads, and review suspicious executions carefully.

Users should avoid pirated installers and never disable protection to run them on personal devices. For another supply-chain example, the Solana FakeFix supply-chain campaign shows why unverified software sources can quickly expose credentials and sensitive data.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Domain	`itorrents[.]org`	Public torrent-file repository reported as compromised and used to distribute malicious torrent files
File name	`the odyssey (2026) [1080p] [webrip] [5.1].exe`	Example MovieReaper loader filename masquerading as a movie release
MD5 hash	`4334BBAEA8DE33BF9D45E9B4E4E3BC2`	MovieReaper-related file hash
MD5 hash	`4843F9FAFCAE492F11E2D4D33DBB4CDD`	MovieReaper-related file hash
MD5 hash	`5310CABAE3FBE6DB8742849B588093F9`	MovieReaper-related file hash
MD5 hash	`A0B13781EDD7CFDAB13D79AFFF3C83C1`	Hash associated with the commonly distributed initial loader
MD5 hash	`70060341CAF3338697A7DDFE0FB62875`	MovieReaper-related file hash
MD5 hash	`AD4643EEA15AC286FA47D1131F9EF756`	MovieReaper-related file hash
MD5 hash	`D0B967571AC8A3863C7F324BF5BDE99C`	MovieReaper-related file hash
MD5 hash	`D88D550D0FB8E60CFFFF3EA61FF7A067`	MovieReaper-related file hash
File path	`%ProgramData%\Microsoft\Windows\Telemetry\msedge.exe`	Persistence location used to masquerade the malware as a Windows telemetry executable
Mutex	`Global\E4AyDKzvEhe2hgAr`	Observed MovieReaper loader mutex
Mutex	`Global\fnulSktzSqvVLXHU`	Observed MovieReaper loader mutex
Domain	`deadhub[.]org`	First-stage command-and-control domain used to retrieve shellcode
IP address	`193.23.118[.]155`	Fallback first-stage command-and-control IP address
URL path	`/cloud/v192.4/ui/sync-status-icons.png`	Example path used to request shellcode fragments
URL path	`/cloud/v192.4/onboarding/welcome-bg.jpg`	Example path used to request shellcode fragments
URL path	`/cloud/v192.4/ui/file-preview-placeholder.png`	Example path used to request shellcode fragments
URL path	`/cloud/v192.4/shared/link-banner.jpg`	Example path used to request shellcode fragments
Solana RPC endpoint	`api.mainnet.solana.com/getAccountInfo`	Blockchain endpoint queried to obtain later-stage C2 information
Solana account	`6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm`	Account containing encoded data used to resolve the second-stage C2
Solana program	`CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL`	Solana program reportedly used by the attackers to store account data
IP address	`208.64.33[.]90`	Second-stage command-and-control infrastructure
IP address	`208.94.246[.]53`	Second-stage command-and-control infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Hackers Poison Movie Torrents With MovieReaper Malware That Uses Solana for C2 appeared first on Cyber Security News.