Crypto-Stealing Malware Disguised as Pirated ‘The Odyssey’ Downloads

Cybersecurity researchers at Bitdefender have uncovered a sophisticated new attack targeting cryptocurrency holders. Scammers are distributing pirated copies of the recently released blockbuster film “The Odyssey” that actually contain Lumma Stealer, a malware variant specifically engineered to extract cryptocurrency wallets and sensitive account credentials from infected machines. The operation emerged remarkably swiftly—within days of the film’s theatrical debut—demonstrating how rapidly attackers capitalize on cultural moments to deploy harmful software.

Deception Through Familiar Icons and Hidden File Extensions

The attack exploits a combination of social engineering and technical deception. Perpetrators designed their malicious packages to mimic legitimate video distributions, adopting standard torrent naming conventions and release formatting. They further disguised the executable files by overlaying icons resembling VLC Media Player and other mainstream video software. This tactic capitalizes on a Windows default behavior that conceals file extensions, meaning users viewing files on their desktop see only the filename and icon, rendering a malicious “.exe” file visually indistinguishable from an actual video file.

Upon execution, Lumma Stealer immediately activates its payload. The malware systematically scans systems for cryptocurrency wallets while harvesting stored passwords, payment card data, autofill credentials, and browser session information. Most alarming is its ability to exfiltrate authentication cookies—digital tokens granting direct account access. This proves particularly dangerous because victims maintaining multi-factor authentication remain vulnerable; stolen cookies bypass these security layers entirely, granting attackers immediate unauthorized access to email accounts, cryptocurrency exchanges, and other sensitive services.

According to Bitdefender, the firm successfully identified and blocked the malicious downloads while flagging associated command-and-control infrastructure. The security researchers also documented a striking precedent: an nearly identical campaign in 2025 distributed the same malware embedded within fake copies of “Mission: Impossible – The Final Reckoning,” indicating attackers deliberately refine and recycle proven attack methodologies.

A Persistent Vulnerability in the Cryptocurrency Ecosystem

This incident exemplifies a troubling pattern where attackers consistently bundle wallet-stealing code into products and services that users actively desire. Recent malware campaigns have hidden inside fraudulent CAPTCHA interfaces routed through blockchain networks, malicious mobile applications, anime-themed wallpapers targeting gaming communities, and compromised Python libraries distributed through legitimate software repositories. The common thread: concealing dangerous code within something people willingly download.

This strategy dramatically outperforms traditional attack vectors. Malware bundled with genuinely desirable content achieves substantially higher infection rates than phishing emails or conventional social engineering approaches. Cryptocurrency remains an especially attractive target because successful compromises directly translate to tangible financial losses, creating powerful incentives for attackers to refine these distribution methods and target crypto users specifically.

Bitdefender’s research underscores why the software supply chain presents persistent vulnerability for digital asset holders. For cryptocurrency users, the findings reinforce a critical lesson: verifying software sources and maintaining cautious behavior around untrusted downloads remains essential protection against increasingly sophisticated theft campaigns that exploit user convenience.

Source: Bitdefender, via Decrypt. Not financial advice.