Fake The Odyssey movie downloads used to spread malware that targets passwords and crypto wallets

Cybersecurity firm Bitdefender has identified multiple fake downloads tied to Christopher Nolan’s new film The Odyssey that were actually delivering Lumma Stealer, a malware strain built to harvest passwords, browser data and cryptocurrency wallet information. The files were disguised as pirated movie releases using labels such as 1080p, 2160p, WEBRip, Blu-ray and H264, with some filenames also including familiar torrent-related terms like EZTV to appear more believable. According to Bitdefender, the supposed movie files were in fact Windows .exe executables. Attackers also disguised the icons as VLC Media Player or generic video files, taking advantage of Windows settings that may hide known file extensions. Once launched, Lumma Stealer can collect saved browser credentials, payment data, autofill records, remote desktop login details and wallet-related information. Browser authentication cookies were also a major target, which could let attackers hijack active sessions even when multi-factor authentication had been enabled. Bitdefender said it confirmed at least three malicious domains connected to the campaign and had blocked them for users of its products. The company also noted that LummaC2, another name for Lumma Stealer, has been linked to at least 1.7 million information-theft incidents and continues to appear in new campaigns despite past law-enforcement action against parts of its infrastructure.