A fake South Park episode in Sonarr was an 887 MB infostealer
The torrent had 2,392 seeders and looked like a normal release. Sonarr could not import it, so it retried every 90 seconds while qBittorrent reported it finished with 0 bytes downloaded.
The file was a Windows .exe, not video. Only its first 118 KB was a real program; the rest was padding, so scanners would give up. It decrypted a hidden payload and ran it in memory: an infostealer after browser passwords, crypto wallets, SSH and cloud credentials.
The author's fix for *arr users: exclude .exe, .scr, .lnk, .bat and .cmd in qBittorrent.
A release that would not import
The post describes a release named "South Park S29E03 1080p WEB H264-MeGusta" that Sonarr, the TV-download manager, grabbed from public trackers. It was an 887 MB Windows executable. The author blocklisted it, then downloaded it again to take it apart.
Only the first 118 KB is a real program. The rest is padding, probably meant to make scanners give up. The loader is full of junk XOR operations to confuse decompilers. It reads a 64-byte footer holding a key, a nonce and flags, decrypts a hidden payload with ChaCha20, maps it into memory by hand and runs it without touching disk. One flag value turns on anti-debugging and anti-sandbox checks, and if triggered the program quietly exits.
What the payload steals and where it phones home
The 929 KB payload is an infostealer written in C++20. Its strings are encrypted with AES-128-CTR; the author decrypted 601 of 672 call sites by emulating the code with Unicorn. Targets: browser passwords, cookies and autofill, crypto wallets, password managers, Telegram and Discord tokens, Steam and other gaming accounts, SSH, AWS, Azure and Kubernetes credentials, VPN configs, email and desktop documents. The data is zipped and sent out.
Its command-and-control address hides in a YouTube channel and a GitHub gist. Decoding them reveals the domain beenetprotect[dot]com, registered through Cloudflare on September 14, 2026, the same day as the channel. Builds are dated October 6 and the torrent was posted October 8.
It was never one fake episode
The thread says the South Park release was one copy of a flood. A commenter running the bitmagnet DHT crawler searches popular titles regularly:
"Pretty much everything even slightly popular that I search for has one of these EXEs lying around. Sometimes multiple." — commenter running the bitmagnet DHT crawler
A commenter who looked at a Pirate Bay mirror saw its recent feed full of .exe files of identical size in every category, and VirusTotal called one a dropper, though the commenter noted that VirusTotal is not definitive proof. So the 887 MB size is a template, not a one-off.
The takeaway for anyone running the *arr stack
The author reports no takedown of the domain or the torrent. His advice: add *.exe, *.scr, *.lnk, *.bat and *.cmd to qBittorrent's excluded file names, blocklist bad releases in Sonarr and Radarr with "Remove from client", and demote or remove trackers in Prowlarr that keep serving this malware.
The thread explains why the first step matters most. A commenter who cites several open Sonarr pull requests argued that scoring releases down for ".exe" in the title is a stopgap:
"Doing it in release profiles by bumping down their score is a cute workaround but then the torrents will just stop saying ".exe" in their title." — commenter who cites several open Sonarr pull requests
A filter on the file names inside the torrent is harder to dodge, because a payload that must run still has to look like an executable, though the same commenter warns that some legitimate ISO releases contain such names, so expect the occasional false positive.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
A guest post on Terence Tao's blog mocks AI math as a Library of Babel
"I live to serve the knowledge frontier and nothing else." The narrator of Rikab Gambhir's satire is a researcher who thinks OpenAI's 722 math write-ups in early October are an efficiency gain.