DiCaprio Movie Torrent Lures Users: Agent Tesla Deployed via Malicious LNK and Subtitle File Code Hiding

Cybersecurity researchers have uncovered a sophisticated malware campaign targeting movie pirates with a fake torrent for a Leonardo DiCaprio film, One Battle After Another. The infection vector is a torrent file; the downloaded folder contains a shortcut named CD.lnk that masquerades as the movie launcher, but clicking it triggers a hidden command chain executing malicious scripts buried inside the subtitle file Part2.subtitles[.]srt.

This subtitle file code-hiding technique helps attackers bypass initial scrutiny while exploiting users’ expectation of media files. The campaign uses Living Off the Land tools, deploying a sequence of PowerShell and other LOTL techniques, with standard Windows utilities such as CMD and Task Scheduler to unpack its payload.

The final payload, Agent Tesla, is executed in memory to avoid touching the disk, and after activation it connects to a command-and-control server to control the victim machine. according to Bitdefender, the attack aims at novices who may not recognise torrent red flags and highlights a dangerous evolution in how commodity malware is delivered.