Subtitles of Deception: The Torrent of Malware Battles

The cybersecurity landscape is constantly evolving, with cybercriminals finding new ways to exploit unsuspecting victims. Recently, Bitdefender researchers uncovered a fake torrent for the movie ‘One Battle After Another,’ starring Leonardo DiCaprio, which was being used to distribute malicious malware.

Released on September 26, 2025, ‘One Battle After Another’ is a highly acclaimed movie directed by Paul Thomas Anderson and featuring a star-studded cast including Leonardo DiCaprio, Sean Penn, and Benicio del Toro.

What makes this malicious torrent unique is its complex and stealthy infection chain. The torrent file contains a movie file, image files, a subtitles file, and a shortcut file that serves as a movie launcher. When the shortcut is executed, it triggers a series of Windows commands that extract and run a malicious PowerShell script hidden within the subtitle file.

This PowerShell script then extracts encrypted data blocks from the subtitles file to create multiple PowerShell scripts that are dropped onto the host machine. These scripts act as a malware dropper, executing various stages of the malware infection process.

Malicious Payload

The final payload of this malware campaign is the AgentTesla RAT malware. AgentTesla, a well-known Windows Remote Access Trojan (RAT), is used by cybercriminals to steal sensitive information such as browser credentials, email login details, and screenshots.

While AgentTesla has been around since 2014, it remains a popular choice for cybercriminals due to its effectiveness and ease of deployment. In other movie-related malware campaigns, different malware families like Lumma Stealer have been observed.

It’s important to note that torrent files from anonymous sources often contain malware, posing a significant risk to users. To stay safe, it is recommended to avoid downloading pirated content, especially new movie releases.

Broken Identity and Access Management (IAM) systems can have far-reaching consequences for businesses beyond just IT issues. To learn more about modern IAM practices and how to build a scalable strategy, download our comprehensive guide.

Get the guide