A fake South Park episode in Sonarr was an 887 MB infostealer (thereallo.dev)
The file was a Windows .exe, not video. Only its first 118 KB was a real program; the rest was padding, so scanners would give up. It decrypted a hidden payload and ran it in memory: an infostealer after browser passwords, crypto wallets, SSH and cloud credentials.
The author's fix for *arr users: exclude .exe, .scr, .lnk, .bat and .cmd in qBittorrent.
Sign in to save