TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report by security researcher Thereallo describes a South Park episode torrent that Sonarr added to a download queue despite it being a Windows executable. Analysis of a downloaded sample found code designed to steal credentials, browser data, wallet information and other files, though the report does not establish how many people downloaded or ran it.
Security researcher Thereallo says a torrent posing as a new South Park episode was selected by Sonarr and contained a Windows executable designed to steal account credentials and other data. The incident highlights a risk for people using public torrent indexers: automation may add a suspicious file to a download client, but a person would still have to run the executable for the reported malware to operate.
In a report on the researcher’s website, Thereallo said the file appeared in the Sonarr queue with a warning-style filename and was listed with 2,392 seeders. The researcher reported that qBittorrent marked the item finished almost immediately with zero bytes downloaded, and that no file was written to disk in that instance. The report does not explain why the client behaved that way.
Thereallo later downloaded the torrent deliberately for analysis. The report describes an x64 Windows executable of about 118 KB with roughly 886 MB of appended data. The researcher said the executable extracted a hidden payload from that data, decrypted it and loaded it into memory. The analysis identified code to collect browser passwords and cookies, cryptocurrency wallet data, password-manager information, messaging and gaming account details, remote-access credentials, configuration files and desktop documents, then package material for transmission.
The researcher said the sample used anti-debugging and anti-sandbox checks, encrypted strings and a method to retrieve a destination address through online sources. The report also says the destination was present as a fallback in the executable. These findings come from the researcher’s analysis; the article does not provide independent verification, and it reports no confirmed victims or successful data theft.
How a Torrent Can Become a Malware Risk
The report matters because media-management tools can make torrent selection and downloading automatic, while an executable disguised as an episode may remain in a downloads folder where a user can mistake it for the intended video. Sonarr itself does not run the file, according to the researcher; the principal risk described is a person opening it.
If the sample behaves as analyzed, running it could expose passwords, browser sessions, wallet data and sensitive files across a broad range of commonly used software. A stolen browser cookie or account credential can create risks beyond the original computer. The report does not establish that any such compromise occurred, so the impact remains a potential consequence rather than a confirmed outcome.
Thereallo recommended excluding executable and script file types in qBittorrent, blocklisting suspicious releases in Sonarr or Radarr with removal from the download client, and reconsidering trackers that repeatedly serve malicious-looking files. Those steps can reduce exposure, but they do not verify whether a file is safe. Users should not run a suspicious executable to inspect it.
As an affiliate, we earn on qualifying purchases.
From Queue Warning to Malware Analysis
Thereallo’s account began with a warning on a NAS dashboard: a South Park item was stuck in Sonarr’s queue and repeatedly attempting import. The researcher said they blocklisted the release, which removed it from qBittorrent, then chose to download it separately for examination. That deliberate analysis is distinct from the initial automated queue event.
The researcher reported identifying a small first-stage program that read configuration data from the end of its own file and loaded a second Windows executable in memory. The second payload was described as a credential-stealing program with collection routines for numerous applications. The report says the sample used a YouTube channel and a GitHub Gist as part of retrieving a network address, while also containing that address as a fallback. The dates cited for the channel and sample build are September 14 and October 6, respectively, but the report does not specify a year.
“Sonarr can’t run an exe, so it’s not the problem.”
— Thereallo, the researcher
As an affiliate, we earn on qualifying purchases.
Victims and Tracker Reach Remain Unknown
The report does not say how many users encountered the torrent, downloaded it, or ran the executable. It also does not provide independent confirmation of the sample’s capabilities, evidence of data being sent from an infected device, or confirmation that anyone’s accounts or files were compromised. The cited seeder count is a snapshot reported by the researcher, not a measure of downloads or infections.
The report does not name the trackers hosting the file or establish whether the release remains available. It also leaves unexplained why qBittorrent initially recorded zero downloaded bytes, and does not clarify the year associated with the dates in the sample’s timeline. Those gaps limit what can be concluded about the campaign’s scale and current status.
As an affiliate, we earn on qualifying purchases.
Practical Steps for Affected Users
The researcher advised users to configure qBittorrent to exclude executable and script extensions, remove suspicious releases from the client through Sonarr or Radarr, and review trackers that repeatedly return such files. Anyone who finds a suspicious executable should avoid opening it. If it has already been run, users should treat the device and accounts accessed from it as potentially exposed and seek trusted security assistance.
No follow-up investigation, tracker takedown, victim notification or response from the torrent platforms is included in the report. Further confirmation would be needed to establish whether the sample caused infections, whether the reported network destination remains active, and whether the same file or related releases are still circulating.
As an affiliate, we earn on qualifying purchases.
Key Questions
Did Sonarr execute the malware?
Thereallo says Sonarr selected the file but did not run it. The researcher identifies manually opening the executable as the key risk described in the report.
What information did the sample reportedly target?
The analysis describes collection routines for browser credentials and cookies, cryptocurrency wallets, password managers, messaging and gaming accounts, remote-access tools, configuration files and desktop documents.
Are infections or stolen data confirmed?
No. The report details the researcher’s analysis of a sample, but does not confirm victims, successful infections or stolen data.
What should someone do if they find the torrent?
Do not run the executable. The researcher recommends excluding executable and script files in qBittorrent and removing suspicious releases through the media-management and download tools.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
