A fake torrent for Leonardo DiCaprio’s 'One Battle After Another' hides malicious PowerShell malware loaders inside subtitle files that ultimately infect devices with the Agent Tesla RAT malware. The malicious torrent file was discovered by Bitdefender researchers while investigating a spike in detections related to the movie. One Battle After Another is a highly rated Paul Thomas Anderson movie released on September 26, 2025, starring Leonardo DiCaprio, Sean Penn, and Benicio del Toro. Cybercriminals taking advantage of interest around new movies by uploading malicious torrents isn't anything new, but Bitdefender notes this case stands out for its unusually complex and stealthy infection chain. "It's impossible to estimate how many people downloaded the files, but we saw that the supposed movie had thousands of seeders and leechers," explained Bitdefender. The downloaded One Battle After Another movie torrent used in the attacks contains various files, including a movie file (One Battle After Another.m2ts), two image files (Photo.jpg, Cover.jpg), a subtitles file (Part2.subtitles.srt), and a shortcut file (CD.lnk) that appears as a movie launcher. When the CD shortcut is executed, it launches Windows commands that extract and run a malicious PowerShell script embedded in the subtitle file between lines 100 and 103. This PowerShell script will then extract numerous AES-encrypted data blocks from the subtitles file again to reconstruct five PowerShell scripts that are dropped...
Fake ‘One Battle After Another’ torrent hides malware in subtitles
BleepingComputer
·Bill Toulas
·Published Dec 12, 2025
·Updated
Affected Software
1 affected component
Microsoft PowerShell
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses a fake torrent for the movie 'One Battle After Another' that hides malware in subtitle files.
2
What type of malware is spread through the fake torrent?
The fake torrent spreads the Agent Tesla RAT malware through malicious PowerShell loaders.
3
Who discovered the malicious torrent file?
Bitdefender researchers discovered the malicious torrent file during their investigation.
4
What software is primarily affected by the malware hidden in the torrent?
The malware primarily affects devices using Microsoft PowerShell.
5
What is the risk associated with downloading subtitles from this torrent?
Downloading subtitles from this torrent can lead to device infection with malicious malware.