Malware Named "MovieReaper" Hijacks Pirated Movie Torrents, Employs Solana Blockchain for Command‑and‑Control

Security researchers have identified a new Windows‑based malware framework, dubbed MovieReaper, that is being delivered to users through illegal movie torrent files. The campaign stands out for its use of the Solana blockchain as a command‑and‑control (C2) channel, a technique that complicates detection and takedown efforts.

The distribution vector emerged after threat actors compromised a publicly accessible repository that stores torrent metadata for several popular tracker sites. By inserting malicious entries into this shared repository, the attackers ensured that the infected .torrent files appeared alongside legitimate releases, exposing anyone who downloads the pirated movies to the payload.

MovieReaper employs a multi‑stage infection chain. The first stage is a lightweight downloader that retrieves additional components from obscure hosting services. Subsequent stages drop more sophisticated modules capable of keylogging, credential harvesting, and persistence. Throughout the process, the malware incorporates anti‑analysis tricks such as debugger detection, environment checks, and code obfuscation to evade sandbox environments.

What distinguishes this campaign is its reliance on the Solana blockchain for C2 communication. Instead of contacting traditional servers, the malware reads transaction data on Solana to receive encrypted instructions. This approach leverages the decentralized nature of blockchain networks, making it harder for defenders to pinpoint and block the control infrastructure.

The emergence of MovieReaper raises concerns for both end users and the broader file‑sharing ecosystem. Individuals who download pirated movies risk exposing their systems to a toolset capable of stealing personal data and establishing long‑term footholds. At the same time, the incident underscores how illicit distribution channels can be weaponized to spread sophisticated threats, prompting law‑enforcement and cybersecurity teams to scrutinize torrent‑related infrastructure more closely.

Security firms have begun publishing indicators of compromise and advising users to avoid downloading content from unverified torrent sources. Keeping Windows systems patched, employing reputable antivirus solutions, and using sandboxed environments for any questionable files are recommended mitigations. Analysts will continue to monitor the use of blockchain‑based C2, as its adoption could signal a shift toward more resilient malware architectures.