Skip to content
Malware Targeting Sonarr Users via Fake South Park Torrent

Malware Targeting Sonarr Users via Fake South Park Torrent

First seen 19 Oct 2026, 13:49 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 19, 2026 at 14:52 UTC
  • •Malware disguised as a South Park episode targets Sonarr users.
  • •The payload is hidden in 887 MB of junk data to evade detection.
  • •The malware steals credentials from various applications, including browsers and crypto wallets.

A malware-laden executable disguised as a South Park episode has been discovered on torrent sites, specifically targeting Sonarr users. The malware, which is only 118 KB in size, is hidden within 887 MB of junk data to evade detection. It employs ChaCha20 encryption and uses a unique method to extract its payload from the last 64 bytes of its own file. The payload, a second-stage executable of 929 KB, is designed to steal sensitive information from a variety of applications, including web browsers, cryptocurrency wallets, and password managers. Users reported that the download completed instantly with zero bytes transferred, indicating malicious intent. The malware also utilizes a YouTube channel as a command and control server. This incident highlights the ongoing risks associated with downloading files from torrent sites.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-17
Malware discovered targeting Sonarr users
A user found a fake South Park episode on torrent sites that contained credential-stealing malware.
News.Lavx.Hu
2026-10-19
Detailed analysis published
Technical analysis revealed the malware's obfuscation techniques and payload extraction methods.
Gigazine

More articles in this cluster (4)

Extracted Entities (15)

1 / 3

Common questions

How does the malware operate?
The malware reads its own file to decrypt a hidden payload, which is executed entirely in memory.
What applications are targeted by the malware?
The malware targets web browsers, cryptocurrency wallets, password managers, and various accounts.
What should users do to protect themselves?
Users should avoid downloading files from untrusted sources and consider using security software to detect malware.