Fake movie torrent hides Agent Tesla malware attack

HackRead reports that a seemingly free download of the new Leonardo DiCaprio film, "One Battle After Another," has been discovered to be a sophisticated, multi-step cyberattack targeting Windows users.

Cybersecurity researchers at Bitdefender uncovered the threat within a torrent file, which employed a Living Off the Land (LOTL) technique to evade detection. The attack begins when a user clicks a shortcut file, triggering a chain of PowerShell scripts hidden within a subtitle file. These scripts then extract and execute further malicious programs from other movie files, ultimately deploying the Agent Tesla malware. This remote access trojan (RAT) allows attackers to gain full remote control, enabling them to steal sensitive data or enlist the infected computer into a botnet. The fake torrent was noted to have thousands of seeders and leechers, indicating a significant number of potential victims.

This incident highlights the persistent threat of malware disguised as popular entertainment content. The use of LOTL techniques and in-memory execution makes detection challenging for traditional security software. It underscores the need for users to exercise extreme caution with unauthorized downloads and for cybersecurity firms to develop more advanced threat detection methods to combat evolving attack vectors.

Source: HackRead