Scammers are using fake Odyssey pirate downloads to spread malware that's
more dangerous than the Cyclops and Circe combined

Date:
Tue, 11 Aug 2026 18:05:00 +0000

Description:
Fake downloads of The Odyssey are delivering Lumma Stealer, and the stolen session cookies walk straight past your two-factor authentication

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Bitdefender says fake pirated downloads of The Odyssey , disguised as scene releases with .exe files carrying VLC icons, are spreading Lumma Stealer malware Stolen session
cookies are the real danger, because they let an attacker resume an authenticated session without ever triggering a multi-factor prompt These builds seemingly ship without droppers or persistence, which is less sophisticated than earlier movie-themed samples but no less harmful, since credential theft does not require staying resident With The Odyssey set to became one of the year's biggest theatrical launches, people looking for a free copy online started finding one with a few extra caveats in tow.

What they were actually downloading, according to Bitdefender , was Lumma Stealer, a prominent infostealer that operates as a Malware-as-a-Service (MaaS). The company's researchers say its security products blocked users
from downloading and running malicious files disguised as the film, circulating under names designed to look like scene releases: "the odyssey 2026 1080p webrip-lama.exe" is one of three examples published, alongside variants dressed as 2160p HD and H. 264 rips. Latest Videos From TechRadar Watch full video here: A regular occurrence for pirates The threat is a well-worn playbook rather than a new one, as Bitdefender documented a near-identical campaign in 2025 built around Mission: Impossible The Final Reckoning , distributing the same malware family through torrent sites using files dressed as movie releases. The blockbuster changes; the delivery does not.

The most useful detail in the report is also the least dramatic, and it explains why a file extension that should be a screaming red flag frequently is not: Windows does not show file extensions by default. You may like
Hackers are hijacking legitimate news websites and reviews to drum up publicity Fake X-VPN installers found to spread credential-stealing malware here's how to stay safe Huge hacking campaign uses spoofed Ghidra, dnSpy, and SpiderFoot security tools to harvest ad revenue and serve malware

Unless a user has enabled that option in Explorer settings, the ".exe" at the end of a filename is simply invisible. Attackers pair that with a custom
icon, commonly one lifted from VLC Media Player or a generic video file, so what appears on screen is a VLC icon and a filename that reads like a movie rip. There is nothing visible to distinguish it from the thing the user was actually looking for.

Bitdefender's point about social engineering follows from that, and it is a sharp one: almost none is required here. Someone hunting for a leaked copy of a film still in theaters has already accepted that they will be dealing with odd filenames, unofficial sources, and compressed archives. An executable claiming to be a video player or installer is not an uncommon sight in the world of piracy, where such practices are rife. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Lumma, also tracked as LummaC2, is a Russian-developed information stealer sold as a service, with affiliates paying somewhere between $250 and $1,000 a month for access. Upon execution, it harvests browser passwords, authentication cookies, saved payment information, cryptocurrency wallet
data, autofill data, and remote desktop credentials.

It has often been highlighted as one of the most prolific MaaS options out there and has had Microsoft, the DOJ, and the FBI act directly against it in the past, but has managed to stay alive since, evolving into a more stealthy entity.

Bitdefender notes that the samples in this campaign arrive without droppers and without persistence mechanisms. What to read next Experts warn this fake Claude install guide can be used to empty crypto wallets Hackers use fake Adobe and Zoom updates to load malware onto victim devices New 'scareware' attack hits 2.8 million victims, pretending to lock them out of your browser

Previous movie-themed Lumma builds carried more machinery, including delayed execution when security software was detected and encrypted payload delivery through AutoIt scripts. The approach here differs considerably: the attackers appear content with whatever they can collect at execution time and do not attempt to hold the machine afterward.

Prevention in this case simply involves avoiding the download of pirated
films from channels that, as a rule of thumb, do not implement many, if any, security measures to keep infostealers out.

For those seeking a broader solution, enabling file extensions in Windows Explorer is the way to go. It takes seconds, it is off by default, and it removes the specific blind spot this particular campaign depends on. Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/scammers-are-using-fake-odyssey-pirate- downloads-to-spread-malware-thats-more-dangerous-than-the-cyclops-and-circe-co mbined


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)