# Torrent site hijacked to spread Windows malware

> Hackers compromised iTorrents.org to distribute MovieReaper malware disguised as pirated movies to hundreds of victims worldwide.
- Title: Torrent site hijacked to spread Windows malware · PCMAG
- Summary: Hackers compromised iTorrents.org to distribute MovieReaper malware disguised as pirated movies to hundreds of victims worldwide. Avoid downloading torrents…
- Keywords: itorrents.org, malware, moviereaper, windows, kaspersky, torrent, malware distribution, trojan, solana blockchain, piracy, cybersecurity, technology
- Source: PCMAG — https://pcmag.com/news/itorrentsorg-compromised-to-spread-windows-malware-kaspersky-says
- Author: Michael Kan
- Published: 2026-09-17T14:29:29+00:00
- Read time: 1 min
- Topics: itorrents.org, malware, moviereaper, windows, kaspersky, torrent, malware distribution, trojan, solana blockchain, piracy, cybersecurity, technology
## Popular torrent site hijacked
Hackers compromised iTorrents.org, a free torrent repository, to spread Windows malware to hundreds of victims across Russia, Japan, Spain, the Netherlands, and Colombia.
## Malware hidden in fake movies
The malware circulated through disguised pirated films, including Christopher Nolan's The Odyssey, which had only been released in theaters at the time.
## One compromise reaches many
By compromising iTorrents.org, attackers could distribute malware through multiple torrent trackers without hacking each platform individually, multiplying their reach.

> This approach is particularly powerful because the threat actors can reach users of multiple trackers without compromising each platform individually.
## Site still spreading malware
iTorrents.org remains compromised. When users download torrents via magnet links, the site returns malicious files instead, triggering downloads of the MovieReaper malware loader.

> iTorrent.org remains compromised.
## MovieReaper malware details
The malware contains 21 functions including the ability to download, upload, read files, and exfiltrate data. It communicates with hackers using the Solana blockchain.
## Wide range of targets hit
The malware infected organizations across enterprise, government, IT, consulting, retail, transportation, and agriculture sectors, showing the attack's broad impact.
## How to stay safe
Avoid downloading from iTorrents.org and similar compromised sites. Windows Defender flagged the malware as Trojan Win32 Sonbokli A, so keep your antivirus updated.
## Key takeaway

Avoid downloading torrents from compromised sites. iTorrents.org remains infected and is distributing malware disguised as popular movies.