2 min read
Security researchers are warning that cybercriminals are exploiting the upcoming Christmas 2025 holiday season by embedding fileless malware in pirated movie torrents, posing a significant threat to users who download unauthorized content online. The malicious campaign has been tied to fake versions of popular films circulating on torrent and peer-to-peer networks, raising alarms about holiday-season cyber threats.
Holiday movie releases typically generate heightened interest among viewers, and threat actors are capitalizing on that demand by disguising malware within torrent files that appear legitimate. One high-profile example involves a bogus torrent of the Leonardo DiCaprio film One Battle After Another, which cybersecurity firm Bitdefender says was used to launch the Agent Tesla remote access trojan. This technique lures unsuspecting users into downloading what they think is a movie file but instead installs malware on their computers.
Unlike traditional malware that writes files directly to a system’s storage, the fake torrent campaign leverages fileless infection methods that execute malicious payloads entirely in memory. In this case, the torrent package contains obfuscated scripts and auxiliary files that, once opened, trigger a multi-stage execution chain using legitimate Windows tools such as PowerShell and command-line utilities. These techniques help the malware evade detection by some security products and leave fewer forensic traces.
Once Agent Tesla is active, it can give attackers remote control over the infected device, allowing them to steal sensitive information such as passwords, financial data, browser history and login credentials. Infected machines can also become part of a larger botnet for future attacks or data exfiltration campaigns.
bitdefender.com
Security experts have repeatedly warned that downloading pirated media is not worth the risk, especially as holiday-themed and high-profile film releases attract millions of viewers. Previous research into malicious media downloads suggests that threat actors have been increasingly using entertainment-related lures to infect victims, and this year’s Christmas torrent tactic is the latest evolution in that trend.
