Pirated Copies of The Odyssey Used to Spread Lumma Stealer Malware

Bitdefender researchers identified the campaign on August 6, noting that the malicious files mimic standard release formats such as 1080p, WEBRip, and Blu-ray. Filenames like "the odyssey 2160phd (2026) engsubs eztv.exe" are designed to trick users into running code that compromises their systems. Attackers often customize the file icons to resemble VLC Media Player or standard video formats, exploiting the default Windows setting that hides known file extensions to mask the underlying .exe threat.

Once active, the malware scans for browser authentication cookies, which allow attackers to hijack active sessions even when multi-factor authentication is enabled. It also extracts autofill records and crypto wallet data. Bitdefender has blocked several domains associated with the campaign, including auditva[.]cyou and logmabx[.]click. While U.S. authorities previously disrupted the LummaC2 infrastructure in 2025—seizing domains linked to an estimated 1.7 million theft incidents—the persistence of this latest campaign underscores the continued use of popular media as a primary delivery vector for information-stealing software.