A movie torrent could deliver the same Windows malware even when users chose different films. In a September 17 investigation, Kaspersky researchers traced MovieReaper to a compromised shared repository of torrent files, rather than separate break-ins at every tracker. The resulting download looked like a movie release but ended in .exe; running it started a chain that ultimately gave an operator access to files on the PC.
The researchers identified several hundred victims across multiple countries, including individuals and organizations. They began investigating this campaign in mid-August 2026 and linked earlier activity by the same actor to October 2025. Those are research observations, not a count of every infected computer or evidence that every torrent site is affected.
One shared repository changed what multiple sites delivered
The key discovery was itorrents[.]org, a public repository used to retrieve torrent files. According to the report, attackers compromised that shared service. Sites relying on it could then deliver a substituted torrent that pointed to the malware loader instead of the requested content. The researchers said the repository remained compromised when their report was published.
This explains why moving to another listing might not help: different pages could depend on the same source for the underlying torrent file. The report does not establish that every magnet link or every torrent client automatically executes malware. The documented infection chain required the user to start the downloaded Windows application.
One observed name was the odyssey (2026) [1080p] [webrip] [5.1].exe. The movie title and release-style details supplied the disguise; the final extension identified a program. Researchers found an identical loader hash under multiple names. A familiar application icon or a convincing release name therefore did not establish what the file would do.
Solana supplied an address, not the whole attack
After execution, the loader checked its environment and fetched code from an attacker-controlled server. It could fall back from a domain to a hard-coded IP address. The next stage queried an account on the legitimate Solana blockchain and decoded stored data to recover the address of another command server.
That division matters. Solana served as an address-discovery layer; the operator’s server still delivered further modules. The finding is not evidence of a Solana vulnerability or a requirement for victims to own cryptocurrency. It also does not make the attack impossible to interrupt: the researchers identified the first-stage domain and IP as a comparatively concentrated point for disruption.
The researchers’ diagram shows a restart in the middle of the chain. That restart changes which module the command server sends next, rather than simply replaying the original download.
The “movie” returned as msedge.exe
A downloaded module attempted to bypass Windows User Account Control, establish persistence, and move the loader to C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe. It then restarted the program. The relaunched instance signaled its new location to the server, which could distinguish it from an initial run and send the file-access module.
The recovered final module exposed 21 commands. These allowed an operator to browse directories, read, upload and download files, change or delete them, and request previews before retrieving full files. Researchers suspected additional modules could be delivered on demand; their report does not demonstrate every possible later payload or prove that every victim’s files were stolen.
The msedge.exe name alone is not a verdict on Microsoft Edge. Here, the suspicious combination was a movie executable, the reported Telemetry location, the restart and the remote-control chain. Our earlier MassJacker coverage describes a separate malware operation involving pirated downloads; sharing a delivery theme does not make the campaigns identical.
If you downloaded or ran the supposed film
If you only downloaded the file, do not run it to find out what it is. Remove the unwanted download and check the complete filename and file type. A movie release that asks you to launch an application or disable protection is a reason to stop.
If you ran it, disconnect the affected PC from the network and avoid using it for sensitive accounts. On a work device, contact your security team before deleting potential evidence. Removing the original download alone may leave the renamed loader or persistence behind, even if a security tool already caught one stage.
For a personal Windows PC, Gridinsoft Anti-Malware provides a practical cleanup route: download and install it from the official site, update it, run a Full Scan, review detections, apply cleanup and restart. If you need network access to obtain updates, limit it to that task. A scan does not prove that no files were accessed. Recover any exposed accounts separately from a trusted device and seek further help if detections or symptoms return.
MovieReaper’s useful warning is more specific than “torrents can be risky”: a shared download dependency can betray several familiar-looking sites, while a long movie filename hides the single decision that starts the chain—running an executable.
References
- Konstantin Isakov and Pavel Cheremushkin. MovieReaper attacks through compromised torrents. Securelist, September 17, 2026.
