Bitdefender has discovered that attackers are using pirated downloads of The Odyssey to spread Lumma Stealer, targeting cryptocurrency wallets, browser passwords, payment information, and logged-in sessions.

Malicious files are disguised as 1080p, WEBRip, H264, or 2160p HD sources, but are actually Windows executable files, such as "the odyssey 2026 1080p webrip-lama.exe"; normal video files do not end with .exe.

Attackers also configure video player icons like VLC Media Player for the executable files. Windows defaults may hide known file extensions, causing victims to only see movie titles and media icons, while ignoring that they are actually programs.

Once users run the file, Lumma collects saved passwords from browsers, autofill records, payment data, remote desktop credentials, and local encrypted wallet data, sending the information to infrastructure controlled by the attackers.

Lumma also steals browser authentication cookies. Attackers can reuse authenticated sessions, allowing them to bypass two-factor authentication steps like SMS or authenticators in certain scenarios, directly taking over exchange, email, or cloud service sessions.

Bitdefender found in samples that it attempts to connect to control server domain names related to Lumma, including auditva[.]cyou, myroayy[.]cyou, and logmabx[.]click; the company claims to have blocked related files and domains for its customers but did not disclose the number of victims, asset losses, or geographic distribution.

Market mechanisms show that pirated hot content provides a high conversion rate for social engineering entry points, and Lumma operates as Malware-as-a-Service, lowering the development and operational thresholds for attackers. Attackers profit by stealing mnemonic phrases, wallet extension data, browser passwords, and login cookies; wallet holders, exchange users, and individuals storing sensitive credentials bear the direct risk of asset loss and account takeover.

Source: Public Information