Disguised The Odyssey Pirated Files Spread Lumma Stealer
Bitdefender has discovered that attackers are using pirated downloads of The Odyssey to spread Lumma Stealer, targeting cryptocurrency wallets, browser passwords, payment information, and logged-in sessions.
Malicious files are disguised as 1080p, WEBRip, H264, or 2160p HD sources, but are actually Windows executable files, such as "the odyssey 2026 1080p webrip-lama.exe"; normal video files do not end with .exe.
Attackers also configure video player icons like VLC Media Player for the executable files. Windows defaults may hide known file extensions, causing victims to only see movie titles and media icons, while ignoring that they are actually programs.
Once users run the file, Lumma collects saved passwords from browsers, autofill records, payment data, remote desktop credentials, and local encrypted wallet data, sending the information to infrastructure controlled by the attackers.
Lumma also steals browser authentication cookies. Attackers can reuse authenticated sessions, allowing them to bypass two-factor authentication steps like SMS or authenticators in certain scenarios, directly taking over exchange, email, or cloud service sessions.
Bitdefender found in samples that it attempts to connect to control server domain names related to Lumma, including auditva[.]cyou, myroayy[.]cyou, and logmabx[.]click; the company claims to have blocked related files and domains for its customers but did not disclose the number of victims, asset losses, or geographic distribution.
Market mechanisms show that pirated hot content provides a high conversion rate for social engineering entry points, and Lumma operates as Malware-as-a-Service, lowering the development and operational thresholds for attackers. Attackers profit by stealing mnemonic phrases, wallet extension data, browser passwords, and login cookies; wallet holders, exchange users, and individuals storing sensitive credentials bear the direct risk of asset loss and account takeover.
Source: Public Information
ABAB AI Insight
Lumma is not a new type of attack tool, but rather a subscription-based spyware. Attackers do not need to develop wallet theft, browser decryption, cookie grabbing, and control server modules themselves; they can simply rent mature tools, purchase traffic, and design bait. This shifts cybercrime from being "technology capability-driven" to "distribution and conversion-driven." Movie piracy, cracked software, fake verification code pages, and phishing emails can all serve as distribution channels for the same payload.
There are two funding paths: one is to directly steal wallet extensions and local wallet data, allowing attackers to transfer assets after obtaining recovery phrases, private keys, or decryptable vault data; the second is to take over online accounts like exchanges or email, bypassing completed login verification through session cookies. The second path is more covert, as MFA protects against "new login challenges," while the stolen session itself is already considered authenticated by the server.
This can be contrasted with the Lazarus Group's fake recruitment and fake conference software attacks against cryptocurrency practitioners: both types of attacks do not require breaking blockchain cryptography but rather target private keys, human operations, and endpoint devices. Hardware wallets can reduce the risk of direct private key leakage, but cannot automatically protect users from approving malicious transactions on infected computers, leaking exchange login cookies, or copying and pasting tampered receiving addresses. The attack surface has extended from on-chain contracts to browsers, extensions, and operating systems.
Essentially, this represents a reconstruction of the industrial chain: the value focus of cryptocurrency asset security is shifting from on-chain protection to endpoint identity and session control. The mechanism is that on-chain transfers are usually irreversible; attackers do not need to attack the consensus network but can complete asset transfers with just one usable signature, recovery phrase, or valid session. As MaaS lowers the supply cost of attacks, security software, operating system file visibility, hardware isolation, and transaction confirmation interfaces will become key infrastructure determining personal asset security.
ABAB News · Cognitive Laws
Blockchain is immutable, but endpoint devices can be compromised
Not leaking private keys does not mean accounts are secure
Free content can be the most expensive, often costing all assets