From Thereallo · Thereallo · · 1m 20s
Sonarr Hackers Upload Malware as South Park Episode
Malware disguised as South Park episode targets Sonarr users with data theft.
In brief
Malware disguised as South Park episode targets Sonarr users with data theft. A hacker uploaded a fake South Park episode as malware to Sonarr, stealing passwords and crypto wallets. Originally reported by Thereallo.
Sonarr Warning
My Sonarr dashboard showed a South Park episode stuck in queue with 2,392 seeders.
“WHO is actually falling for this in the big 2026???”
Malware Uploaded
A hacker uploaded a fake South Park episode as .exe with 2,392 seeders to public trackers.
“It's an EXE”
Sonarr Grabbed Malware
Sonarr imported the malware and tried to download it every 90 seconds.
“Import failed, path does not exist or is not accessible by Sonarr”
Malware Behavior
The malware ran in memory without touching disk, using obfuscation to hide its payload.
“It's a real PE, x64 GUI. The actual program is 118 KB”
Stealer Functionality
The malware steals passwords, crypto wallets, and remote access credentials from users.
“osinfo browsers telegram wallets discord steam clipboard remoteaccess”
Data Exfiltration
The malware uses encrypted channels to send stolen data to cloud servers.
“www.youtube.com/channel/UC18vFC1xgebddr_7NsvgBYA”
Cloudflare Domain
The malware uses a Cloudflare domain created on September 14, 2026 for data exfiltration.
“Domain Name: BEENETPROTECT.COM Creation Date: 2026-09-14T06:21:54Z”
Security Fix
Users should block .exe files in qBittorrent and add to Sonarr blocklists.
“qBittorrent : add *.exe, *.scr, *.lnk, *.bat, *.cmd to "Excluded file names"”
Malware Origin
The malware was built using ChaCha20 and AES-CTR encryption to evade detection.
“It's ChaCha20. They hid the constants by building them out of globals”
Impact
The malware targets Sonarr users with data theft across multiple platforms.
“It steals passwords, crypto wallets, and remote access credentials”
The key point
A hacker uploaded a fake South Park episode as malware to Sonarr, stealing passwords and crypto wallets.
