RetroFed Forum
Your home away from modern life.
Attackers have compromised iTorrents, a widely used public repository of torrent files, and used it to spread malware disguised as movies.
Post Reply
AuthorMessage
beep piefed.world beep@piefed.world
Joined: 2026-04-08
Quote

67   Original
CompactFlax discuss.tchncs.de CompactFlax@discuss.tchncs.de
Joined: 2025-02-14
#2 · (edited) Quote Reply

The.Odyssey.full.bluray.rip.avi.exe

Old tricks still work

Edit - Oh shit that’s exactly what they did.

The most popular initial executable was distributed through torrent trackers under many different names (for example, the odyssey (2026) [1080p] [webrip] [5.1].exe),

A big part of why this works, I think, is because windows hides extensions by default.

65
spy lemmy.dbzer0.com spy@lemmy.dbzer0.com
Joined: 2023-06-23
#3 · Quote Reply

The.Odyssey.full.bluray.rip.avi.exe Old tricks still work Edit - Oh shit that’s exactly what they did. The most popular initial executable was distributed through torrent trackers under many different names (for example, the odyssey (2026) [1080p] [webrip] [5.1].exe), A big part of why this works, I think, is because windows hides extensions by default.

They forgot to analyze it.
"Hey LLM, is this executable file a good version of the odyssey?"

11
WagnasT piefed.world WagnasT@piefed.world
Joined: 2025-07-10
#4 · Quote Reply

The.Odyssey.full.bluray.rip.avi.exe Old tricks still work Edit - Oh shit that’s exactly what they did. The most popular initial executable was distributed through torrent trackers under many different names (for example, the odyssey (2026) [1080p] [webrip] [5.1].exe), A big part of why this works, I think, is because windows hides extensions by default.

Windows hiding the file extensions drives me insane, from a security as well as a usability standpoint. It's such a stupid default.

51
Taleya aussie.zone Taleya@aussie.zone
Joined: 2023-06-21
#5 · Quote Reply

The.Odyssey.full.bluray.rip.avi.exe Old tricks still work Edit - Oh shit that’s exactly what they did. The most popular initial executable was distributed through torrent trackers under many different names (for example, the odyssey (2026) [1080p] [webrip] [5.1].exe), A big part of why this works, I think, is because windows hides extensions by default.

Well, we're back at the same general level of computer literacy we were at the turn of the century so....

26
lost_faith lemmy.ca lost_faith@lemmy.ca
Joined: 2024-02-13
#6 · Quote Reply

They forgot to analyze it. "Hey LLM, is this executable file a good version of the odyssey?"

"Yes, this is a genuine version of the Odyssey. Simply double click the file and it will run in your video player. Is there anything else I can help with?"

5
CompactFlax discuss.tchncs.de CompactFlax@discuss.tchncs.de
Joined: 2025-02-14
#7 · Quote Reply

Well, we're back at the same general level of computer literacy we were at the turn of the century so....

Worse, I’d argue. They’re so easy to use; in the 2000s there were still some skills involved. Mobile devices really dumbed things down.

9
steelplatedmech piefed.ca steelplatedmech@piefed.ca
Joined: 2026-07-22
#8 · Quote Reply

Well, we're back at the same general level of computer literacy we were at the turn of the century so....

I think boomers were more PC literate which is pretty sad, since they at least knew how to navigate a desktop, folders, and files to some degree.

I think phone or tablet OS is what most people after are used to, so if trying to navigate actual file systems mistakes like not recognizing exe files can happen.

Technology got to a point where it is so accessible the basics are forgotten.

7
monstoor lemmy.dbzer0.com monstoor@lemmy.dbzer0.com
Joined: 2023-06-29
#9 · Quote Reply

I noticed there had been a few dodgy EXEs floating around recently. Not compatible with my OS but worrying nonetheless!

3
ReverendIrreverence piefed.social ReverendIrreverence@piefed.social
Joined: 2026-02-24
#10 · Quote Reply

Jokes on them. I run a Linux distro.

8
django discuss.tchncs.de django@discuss.tchncs.de
Joined: 2023-06-05
#11 · Quote Reply

Jokes on them. I run a Linux distro.

The Wine configuration in /home/user/.wine is being updated, please wait...

10
Daniel Quinn lemmy.ca danielquinn@lemmy.ca
Joined: 2023-06-07
#12 · Quote Reply

They forgot to analyze it. "Hey LLM, is this executable file a good version of the odyssey?"

[LLM executes it to test]

4
dalekcaan feddit.nl dalekcaan@feddit.nl
Joined: 2025-06-26
#13 · Quote Reply

"Yes, this is a genuine version of the Odyssey. Simply double click the file and it will run in your video player. Is there anything else I can help with?"

"You're right, that was a malware executable that stole your bank credentials and ruined your life! I was wrong :)"

5
Venia Silente lemmy.dbzer0.com veniasilente@lemmy.dbzer0.com
Joined: 2025-06-09
#14 · Quote Reply

"You're right, that was a malware executable that stole your bank credentials and ruined your life! I was wrong :)"

"...And you were right to call me out on that. Here's what I did:"

sample of instructions

[execute it to test]

3
𝕸𝖔𝖘𝖘 infosec.pub 01189998819991197253@infosec.pub
Joined: 2023-06-04
#15 · Quote Reply

Windows hiding the file extensions drives me insane, from a security as well as a usability standpoint. It's such a stupid default.

This design choice has caused so much grief over the years. I absolutely hate it

4
DeadEndLink lemmy.ca DeadEndLink@lemmy.ca
Joined: 2026-09-04
#16 · Quote Reply

Jokes on them. I run a Linux distro.

Same. Exe's go in the toilet.

2
DeadEndLink lemmy.ca DeadEndLink@lemmy.ca
Joined: 2026-09-04
#17 · Quote Reply

The Wine configuration in /home/user/.wine is being updated, please wait...

Imagine opening a janky movie file with wine...

I'm a techno vegetable and I wouldn't even do that.

5
BlackFlagsForever lemmy.dbzer0.com BlackFlagsForever@lemmy.dbzer0.com
Joined: 2023-06-19
#18 · Quote Reply

The Wine configuration in /home/user/.wine is being updated, please wait...

you run chmod +x ... in your movie download folder? ;-)

1
BlackFlagsForever lemmy.dbzer0.com BlackFlagsForever@lemmy.dbzer0.com
Joined: 2023-06-19
#19 · (edited) Quote Reply

I run Linux myself but even on windows... if you have qbittorrent 5.1.2+ (not sure in earlier versions; had to open an old vm image to confirm it went back this far)

then anyone who only pirates videos/music could just set qbittorrent > downloads > excluded file names to have *.exe on one of the lines and avoid this easily.

people who do pirate games/software could probably still add something like these to the same setting without disrupting their game/sw dls and still avoid 90+% of these kind of attacks:

*.avi.exe
*.mp3.exe
*.mp4.exe
*.mkv.exe
*dvdrip*.exe
*webrip*.exe
*web.dl*.exe
*web-dl*.exe
*bluray*.exe
*1080p*.exe
*720p*.exe
*480p*.exe
*x264*.exe
*x265*.exe
*hvec*.exe
*av1*.exe
*imax*.exe
*aac5.1*.exe
*hdtv*.exe
*amzn*.exe
*hulu*.exe
*yify*.exe
*yts*.exe
*eztv*.exe

only spot it might need some fine tuning that i can think of is if you have the occasional fitgirl pack that has optional stuff for 720 vs 1080 videos as a selective download... and you should really be looking at those when you download anyway

1
django discuss.tchncs.de django@discuss.tchncs.de
Joined: 2023-06-05
#20 · Quote Reply

you run chmod +x ... in your movie download folder? ;-)

I assumed wine needed the flag, not the exe file, as the program being executed is wine.

1
Post Reply
Back to top