Christopher Nolan’s The Odyssey had barely reached theaters before scammers began targeting people searching for pirated copies, according to Malwarebytes.
Within hours of the film’s release, researchers found two separate scams running on cloned piracy sites: fake browser warnings and Windows executables disguised as movie downloads.
“Neither scam has anything to do with the movie itself. They’re simply taking advantage of people searching for a popular new release,” Malwarebytes wrote.
Fake browser warning pushes visitors into ad networks
On sites built to look like well-known piracy trackers, researchers found a pop-up reading “Browser Issue Detected,” claiming a missing component was blocking access to the site. The message included a large “Fix It Now” button and a smaller option to close it.
The fake “Browser Issue Detected” warning (Source: Malwarebytes)
“There was no missing browser component. The entire pop-up was part of the webpage itself, designed to look like a genuine browser warning,” they explained.
Clicking “Fix It Now” sent visitors through a malvertising network. Where they landed next depended on the ad campaign running at that moment, and included fake browser extensions, scareware urging a call to a fake support number, or additional malware redirects.
Malwarebytes found the same pop-up, with identical wording and layout, on several different cloned sites, with only the color scheme changed. The sites reproduced real torrent listings, artwork, and cast information for the movie, which points to a coordinated campaign rather than legitimate torrent sites that had been compromised.
Download file was a program, not a video
The second scam targeted people trying to download the movie itself. A file named The Odyssey 2026 1080p WEBRip-LAMA was listed with 597 seeders and 520 leechers, but ended in .exe.
Torrent listing for “The Odyssey 2026 1080p WEBRip-LAMA.exe (Source: Malwarebytes)
Windows identified the file as an application. Legitimate movie downloads use formats such as .mkv, .mp4, or .avi, which are opened by a media player rather than executed as programs.
The file description read “wireless bus Business Controller,” unrelated to video playback, and likely left over from the software used to build the executable. The file also displayed the orange traffic cone icon associated with VLC Media Player, despite being unrelated to it.
“That’s a classic social engineering trick. VLC is one of the world’s most widely used media players, so many people instinctively associate its icon with a harmless video,” researchers noted.
What happens after the file runs depends on the specific campaign delivering it, and can include a trojan, an infostealer, a loader for additional malware, or ransomware.
Neither scam used a software vulnerability
Both scams relied on convincing someone to take an action, either clicking a fake warning or running an executable disguised as a movie, rather than exploiting a flaw in software.
According to Malwarebytes, this makes the scams harder to prevent through security software alone, since browsers cannot distinguish a page-rendered warning from a genuine one, and antivirus tools cannot flag every executable based on icon or metadata.
The Odyssey carries a $250 million budget and a year of ticket pre-sales, which might explain why the scams surfaced within hours of release rather than weeks later.
“If you’re downloading a film and it asks you to install something, fix your browser, or run an .exe, you’re almost certainly not getting a movie. You’re downloading software that could infect your computer,” researchers concluded.
