- Bitdefender says fake pirated downloads of The Odyssey, disguised as scene releases with .exe files carrying VLC icons, are spreading Lumma Stealer malware
- Stolen session cookies are the real danger, because they let an attacker resume an authenticated session without ever triggering a multi-factor prompt
- These builds seemingly ship without droppers or persistence, which is less sophisticated than earlier movie-themed samples but no less harmful, since credential theft does not require staying resident
With The Odyssey set to became one of the year’s biggest theatrical launches, people looking for a free copy online started finding one with a few extra caveats in tow.
What they were actually downloading, according to Bitdefender, was Lumma Stealer, a prominent infostealer that operates as a Malware-as-a-Service (MaaS).
The company’s researchers say its security products blocked users from downloading and running malicious files disguised as the film, circulating under names designed to look like scene releases: “the odyssey 2026 1080p webrip-lama.exe” is one of three examples published, alongside variants dressed as 2160p HD and H. 264 rips.
A regular occurrence for pirates
The threat is a well-worn playbook rather than a new one, as Bitdefender documented a near-identical campaign in 2025 built around Mission: Impossible – The Final Reckoning, distributing the same malware family through torrent sites using files dressed as movie releases. The blockbuster changes; the delivery does not.
The most useful detail in the report is also the least dramatic, and it explains why a file extension that should be a screaming red flag frequently is not: Windows does not show file extensions by default.
Unless a user has enabled that option in Explorer settings, the “.exe” at the end of a filename is simply invisible. Attackers pair that with a custom icon, commonly one lifted from VLC Media Player or a generic video file, so what appears on screen is a VLC icon and a filename that reads like a movie rip. There is nothing visible to distinguish it from the thing the user was actually looking for.
Bitdefender’s point about social engineering follows from that, and it is a sharp one: almost none is required here. Someone hunting for a leaked copy of a film still in theaters has already accepted that they will be dealing with odd filenames, unofficial sources, and compressed archives. An executable claiming to be a video player or installer is not an uncommon sight in the world of piracy, where such practices are rife.
Lumma, also tracked as LummaC2, is a Russian-developed information stealer sold as a service, with affiliates paying somewhere between $250 and $1,000 a month for access. Upon execution, it harvests browser passwords, authentication cookies, saved payment information, cryptocurrency wallet data, autofill data, and remote desktop credentials.
It has often been highlighted as one of the most prolific MaaS options out there and has had Microsoft, the DOJ, and the FBI act directly against it in the past, but has managed to stay alive since, evolving into a more stealthy entity.
Bitdefender notes that the samples in this campaign arrive without droppers and without persistence mechanisms.
Previous movie-themed Lumma builds carried more machinery, including delayed execution when security software was detected and encrypted payload delivery through AutoIt scripts. The approach here differs considerably: the attackers appear content with whatever they can collect at execution time and do not attempt to hold the machine afterward.
Prevention in this case simply involves avoiding the download of pirated films from channels that, as a rule of thumb, do not implement many, if any, security measures to keep infostealers out.
For those seeking a broader solution, enabling file extensions in Windows Explorer is the way to go. It takes seconds, it is off by default, and it removes the specific blind spot this particular campaign depends on.
