Alert in Latin America for movies that hide malware and can give remote access to your PC

The deception takes advantage of an everyday action: searching for a movie, finding a file with the expected title and downloading it thinking it is a video. However, some of these files end in “.EXE,” an extension used by Windows to run programs. In other words, when a person tries to open what they think is a movie, they may actually be launching a malicious program inside their computer.

These files usually circulate on pages that facilitate so-called torrent downloads, a system through which different users download and share files directly between computers connected to the Internet. Although this technology also has legitimate uses, it is common to find it on sites that offer movies, series, video games or programs without authorization. In these spaces, a file can be presented with the name and appearance of known content without necessarily having a provider to previously verify what it contains.

The campaign has already left victims in different regions of the world, including Latin America, as well as in Russia, Turkey, Japan, Kenya, Uganda and several European countries, including Spain, the Netherlands, Belgium and Germany. Among the titles used as a decoy is The Odyssey, as well as other film productions.

During the analysis of the campaign, researchers identified an infection in Colombia that occurred in August. The user had downloaded a file that appeared to correspond to the movie The End of Oak Street (2026), but in reality it was a malicious program.

The case illustrates how deception works and why it can spread to other markets in the region. The files and sites used to distribute them are accessible from different countries and do not depend on a campaign designed exclusively for one market. For this reason, the same lure can circulate among users from different places in Latin America, especially when searching for new releases or popular content outside of official platforms.

Once the file is executed, the malware deploys different components within the computer to avoid detection, remain installed, and obtain greater permissions on the system.

Among its capabilities is the ability to remain active even after the device is rebooted. You can also try to gain Windows administrator privileges without displaying the usual warnings to the user and eventually allow attackers to remotely access the compromised computer.

This means that a download that begins with the intention of watching a movie may end up giving third parties a way into the device. Depending on the information stored and the accounts used from that computer, the risk can extend to credentials, documents, emails and other resources to which the victim has access.

The threat takes on an additional dimension when the computer is also used for work. A download done for personal purposes can end up exposing corporate accounts, company documents, cloud services, or access used to perform work tasks.

The campaign also incorporates a resource that makes it difficult to interrupt: the malware uses the Solana blockchain network to locate the infrastructure from which it receives instructions. In simple terms, this prevents attackers from relying solely on one server or Internet address, making it more complex to completely block the operation.

“This type of campaign works because the attacker takes advantage of an action that for many people seems completely everyday: searching for a movie on the Internet. The title is recognizable, the file appears in a place where the user expects to find that content and everything is designed to reduce the feeling of risk. When the person opens the file,

believing that it is going to play a video, you may be taking the first step for malware to install itself and attackers to gain access to the device,” explains Lisandro Ubiedo, senior security analyst at Kaspersky.

“In addition, this type of threat is not limited to a specific country. The same file can circulate among users in different markets without the attackers needing to develop a different campaign for each one. Added to this is that today the same computer usually concentrates a good part of personal and work life; an infection that begins with an entertainment download can end up exposing much more information than the victim imagines,” adds Ubiedo.

• Download movies, games and other content only from official sources or trusted sites. Files circulating on unofficial pages may have been modified to include malware.
• Use a reliable security solution on computers and mobile devices. These types of tools can detect dangerous files and block threats before they infect your computer.
• Do not disable antivirus or other security tools to download or open files. If a page or program asks to do this, it should be considered a red flag.