# Sonarr Hackers Upload Malware as South Park Episode

> Malware disguised as South Park episode targets Sonarr users with data theft.
- Title: Sonarr Hackers Upload Malware as South Park Episode | Shortify
- Summary: Malware disguised as South Park episode targets Sonarr users with data theft. A hacker uploaded a fake South Park episode as malware to Sonarr, stealing…
- Keywords: sonarr, radarr, qbit, malware, stealer, chacha20, crypto wallets, data theft, torrent sites, south park, technology, startups
- Source: Thereallo — https://thereallo.dev/blog/someone-on-torrent-sites-kept-fucking-with-my-sonarr-setup
- Author: Thereallo
- Read time: 1 min
- Topics: sonarr, radarr, qbit, malware, stealer, chacha20, crypto wallets, data theft, torrent sites, south park, technology, startups
## Sonarr Warning
My Sonarr dashboard showed a South Park episode stuck in queue with 2,392 seeders.

> WHO is actually falling for this in the big 2026???
## Malware Uploaded
A hacker uploaded a fake South Park episode as .exe with 2,392 seeders to public trackers.

> It's an EXE
## Sonarr Grabbed Malware
Sonarr imported the malware and tried to download it every 90 seconds.

> Import failed, path does not exist or is not accessible by Sonarr
## Malware Behavior
The malware ran in memory without touching disk, using obfuscation to hide its payload.

> It's a real PE, x64 GUI. The actual program is 118 KB
## Stealer Functionality
The malware steals passwords, crypto wallets, and remote access credentials from users.

> osinfo browsers telegram wallets discord steam clipboard remoteaccess
## Data Exfiltration
The malware uses encrypted channels to send stolen data to cloud servers.

> www.youtube.com/channel/UC18vFC1xgebddr_7NsvgBYA
## Cloudflare Domain
The malware uses a Cloudflare domain created on September 14, 2026 for data exfiltration.

> Domain Name: BEENETPROTECT.COM Creation Date: 2026-09-14T06:21:54Z
## Security Fix
Users should block .exe files in qBittorrent and add to Sonarr blocklists.

> qBittorrent : add *.exe, *.scr, *.lnk, *.bat, *.cmd to "Excluded file names"
## Malware Origin
The malware was built using ChaCha20 and AES-CTR encryption to evade detection.

> It's ChaCha20. They hid the constants by building them out of globals
## Impact
The malware targets Sonarr users with data theft across multiple platforms.

> It steals passwords, crypto wallets, and remote access credentials
## Key takeaway

A hacker uploaded a fake South Park episode as malware to Sonarr, stealing passwords and crypto wallets.