Criminals are using fake pirated downloads of Christopher Nolan’s “The Odyssey” to trick people into running password-stealing malware. The files look like normal movie downloads (and may even use VLC-style icons), but are actually Windows executables that install Lumma Stealer to grab saved passwords, cookies, payment data, and crypto wallet details.
This attack takes advantage of public interest in a high-profile movie release, 'The Odyssey,' to spread information-stealing malware. Criminals posted files with names designed to look like pirated movie downloads, using naming conventions common to torrent and streaming-rip sites, such as file names referencing resolution and encoding formats. Instead of a video file, the download is a Windows executable. To reinforce the illusion, the executables can use icons associated with legitimate media players such as VLC, and Windows may hide the .exe file extension by default, making the disguise more convincing.
If a person runs the file expecting to watch a movie, the executable instead installs Lumma Stealer. This malware is designed to collect data stored on the infected device, including browser passwords, authentication cookies, saved payment information, cryptocurrency wallet data, autofill data, and remote desktop credentials.
The lure works because it targets a normal, low-suspicion activity: downloading a movie people are already curious about. Most users expect a video file, not a program, so an executable disguised with a familiar media player icon and a hidden file extension can bypass casual scrutiny. Because Lumma Stealer is sold as malware-as-a-service, this same tactic can be reused repeatedly by different criminal groups, each generating their own versions of the fake 'Odyssey' files.
Organizations and individuals can reduce risk from this type of lure with a few practical habits:
This case is a reminder that social engineering does not require a sophisticated pretext. Familiar cultural moments, like a major movie release, are enough to get people to lower their guard and run an unfamiliar file.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers post fake pirated movie files for 'The Odyssey' that are actually Windows executables. Running the file installs Lumma Stealer malware instead of playing a movie.
Lumma Stealer can collect browser passwords, authentication cookies, saved payment information, cryptocurrency wallet data, autofill data, and remote desktop credentials from an infected device.
Be suspicious if the file is a Windows executable (.exe) instead of a video format like .mp4 or .mkv, since Windows may hide the .exe extension by default and the file may use a legitimate-looking media player icon.
Lumma Stealer is sold as malware-as-a-service, meaning multiple criminals can reuse the same fake movie download scheme with their own variations of the lure.
See a free download for Christopher Nolan’s “The Odyssey”? That “movie” might actually be a password-stealing program. Criminals are hiding Lumma Stealer inside fake Odyssey downloads. The file looks like a normal movie, VLC-style cone icon, Windows hiding the .exe, but when you run it, it starts grabbing your browser passwords, cookies, payment data, even crypto wallets. Here’s the trap: you expect an .mp4 or .mkv, but the download is an .exe program. Windows hides the extension, the VLC icon looks legit, and in one double-click Lumma can hijack work accounts through stolen passwords and auth cookies. One move that kills this scam: in Windows, turn on file extensions and never run a “movie” that ends in .exe. If you see that on a download, delete it, don’t touch it.
Researchers linked DigiCert’s April 2026 breach to a GoldenEyeDog sub-group that tricked support staff into running a malicious file delivered through a customer support chat. The attackers then abused DigiCert’s support portal features to intercept EV code-signing certificate “initialization…
Researchers describe an active campaign ("SMOKE#SCREEN") where attackers trick users with realistic software update and document-themed lures to install a legitimate remote-control tool (ScreenConnect). Once installed, the attacker gains persistent remote access that can look like normal IT…
CERT-UA reported a real phishing campaign where victims receive an email with an image attachment that leads (via a shortened link) to a ZIP download. The ZIP contains a script disguised as a PDF, which installs a malicious Notepad++ plugin and sets up an automated task that repeatedly runs malware…
FortiGuard Labs reports an active phishing operation (“TTF Trap”) where emails posing as invoices, shipping documents, or business proposals deliver an archive that ultimately runs malware on Windows. The trick is a file ending in .ttf (TrueType font) that is actually a malicious script executed by…
Cisco Talos reports a real campaign by a Russian-speaking group (UAT-11795) targeting users in the U.S. and Europe with trojanized installers for popular tools like Zoom, Webex, and MobaXterm. Victims are socially engineered via a “ClickFix” style trick into running a command that silently…
A real, ongoing phishing campaign is tricking recipients into opening malicious archives that appear to contain harmless TrueType font files (.ttf) but actually hide a Lua-based loader. Once executed, the loader uses stealthy, mostly in-memory techniques to install remote access trojans and…
