Scammers are using fake Odyssey pirate downloads to spread malware that's more dangerous than the Cyclops and Circe combined

Cybercriminals are leveraging fraudulent pirate downloads of the highly anticipated film Odyssey to distribute malware that is far more potent than the mythological characters it draws inspiration from. Bitdefender, a cybersecurity firm, reports that these fake downloads come disguised as scene releases, complete with .exe files bearing VLC icons to mimic legitimate movie files.

The real threat lies in stolen session cookies, which enable attackers to continue accessing authenticated sessions without triggering multi-factor authentication prompts. The malware, known as Lumma Stealer, operates as a Malware-as-a-Service (MaaS) and harvests sensitive information such as browser passwords, authentication cookies, payment details, cryptocurrency data, autofill data, and remote desktop credentials.

Unlike previous movie-themed Lumma builds that included more sophisticated persistence mechanisms, this campaign appears content with collecting data at execution and does not attempt to maintain persistence on the infected machine. Bitdefender's researchers note that the samples in this campaign do not include droppers or persistence mechanisms, making the malware less sophisticated but no less harmful due to its ability to steal credentials without staying resident on the system.

To avoid falling victim to this scam, the report advises users to steer clear of downloading pirated films from sources that lack robust security measures. Enabling file extensions in Windows Explorer, which is disabled by default, also helps prevent this specific type of attack.