TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A security researcher reported that a fake South Park episode on public torrent trackers was packaged as a Windows executable and concealed credential-stealing malware. The report says Sonarr queued the file but did not execute it; the risk arises if someone manually opens the downloaded executable. The malware’s reach and the number of people exposed have not been independently established.
A fake South Park episode torrent contained a Windows executable that the report’s author says was designed to steal passwords, browser data, cryptocurrency-wallet information and files. In a post titled “Someone on Torrent Sites Kept Fucking with My Sonarr,” security researcher Thereallo said the file entered a Sonarr queue through a public tracker, but the automation software did not run it; the reported danger is that a person might open the executable manually.
Thereallo said the torrent was named after a South Park episode but ended in .exe, rather than a video file. The author reported that it had 2,392 seeders on public trackers. According to the post, qBittorrent marked the download complete with zero bytes downloaded, so the initial attempt did not leave a file on disk. The researcher later downloaded the file deliberately for analysis and advised readers not to execute it.
The analysis describes a roughly 118 KB Windows program attached to about 886 MB of filler data. Thereallo said the program extracted a second payload from the file, decrypted it and loaded it into memory. The post identifies that payload as a stealer targeting browser credentials and cookies, cryptocurrency wallets, password managers, messaging and gaming accounts, developer credentials, remote-access tools and selected documents. It also says the malware compressed collected data and sent it to an address obtained through online services.
Thereallo reported finding anti-debugging and anti-sandbox checks, as well as code to collect data from a range of applications. These are the researcher’s technical findings, not a public confirmation from a security vendor or law enforcement agency. The author recommended blocking executable and script extensions in qBittorrent and removing suspicious downloads through Sonarr or Radarr’s blocklist controls.
The Risk Is Manual Execution
The report highlights a gap between automated media management and a user’s actions afterward. Sonarr may recognize and queue a release, but the researcher says the program itself cannot execute an .exe as an episode. The exposure described is instead a person opening the file from a download folder, perhaps believing it is a video or required playback component.
If the analysis is accurate, running the payload could put a broad set of credentials and personal files at risk, including saved passwords, session cookies, wallet data and developer keys. That could enable account theft or unauthorized access beyond the computer where the file was opened. The report does not establish that anyone ran the file or suffered a compromise, so those consequences remain potential harms rather than confirmed outcomes.
The practical takeaway is to treat unexpected executable files in media downloads as suspicious and use download-client filtering and tracker controls. Those precautions can reduce accidental exposure, but the post does not show whether the file has been removed from every tracker or whether other releases use the same payload.
Windows malware removal tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How the File Reached Sonarr
Sonarr and related tools such as Radarr automate the management of television and film downloads, often using public indexers and torrent clients. They can select and transfer releases, but the report’s account distinguishes that process from actually launching a downloaded program. Thereallo said Sonarr repeatedly attempted to import the item and that adding it to the application’s blocklist removed it from qBittorrent.
The post says the executable was padded with a large quantity of random data and used layers of obfuscation. The author described extracting the smaller embedded payload and decrypting hundreds of strings through static analysis. The report also says a YouTube channel and a GitHub gist were used to help locate a server address, while that address was reportedly present in the executable as a fallback. These details come from the researcher’s own reverse-engineering account.
Thereallo recommended configuring qBittorrent to exclude extensions such as .exe, .scr, .lnk, .bat and .cmd, and blocklisting suspicious releases in Sonarr or Radarr with removal from the client enabled. The post also advised reconsidering trackers that repeatedly provide suspicious files. These are the author’s mitigation suggestions, not findings from a formal incident-response bulletin.
“Sonarr can’t run an exe, so it’s not the problem.”
— Thereallo, the report’s author
Exposure and Attribution Remain Unknown
The post does not say how many people downloaded or ran the executable, whether any victims were identified, or whether stolen information was successfully received by an operator. It also does not provide independent confirmation from a security company, tracker operator or law-enforcement agency. The malware’s collection capabilities are described by the researcher, but capability alone does not establish that every listed application or file was successfully accessed on a victim’s device.
The report attributes dates to the file and related online accounts, but it does not establish who created the malware or whether the identified accounts and infrastructure belong to the same person. The status of the torrent and the reported server address is also unclear. The source gives no documented count of affected users or comparison baseline, so the reported seeder figure should not be treated as a measure of infections or downloads.
Check Downloads and Tracker Settings
Readers who use public indexers can review their torrent-client exclusion rules and their Sonarr or Radarr blocklists, following the report’s suggested controls. Anyone who has the suspect file should not open it. If it was run, the report does not provide a verified cleanup procedure; users should seek help from a qualified security professional and consider changing exposed account credentials from a separate, trusted device.
Further confirmation would depend on analysis from security researchers or vendors, statements from tracker operators, and evidence about whether the file reached or affected users. The original report does not announce a takedown, a law-enforcement investigation or a confirmed victim count.
Key Questions
Did Sonarr run the executable?
According to Thereallo, Sonarr did not execute it. The author said the application repeatedly tried to import the item, while the risk was a person manually opening the .exe.
What did the executable reportedly contain?
The researcher said the file concealed a second Windows payload described as an information stealer, with code targeting credentials, cookies, wallet data, account information and selected files.
Is there evidence that users were infected?
The report does not establish that anyone ran the file or that accounts or computers were compromised. A seeder count is not a count of downloads or infections.
What precautions did the researcher recommend?
Thereallo suggested excluding executable and script extensions in qBittorrent, blocklisting suspicious releases in Sonarr or Radarr, and reviewing trackers that repeatedly supply suspicious files. The author also said not to run the executable.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
