A developer running the *arr stack (Sonarr, Radarr, and related media management tools) on a NAS discovered malware disguised as a South Park episode on public torrent trackers. The file, named with a .exe extension, had been uploaded with over 2,392 seeders and was automatically grabbed by Sonarr before being identified as malicious.
According to the developer’s analysis, the executable employed heavy obfuscation to evade detection. The actual 118 KB program was padded with 886 MB of random data to bypass file-size limits on antivirus scanners. The malware used XOR operations and ChaCha20 encryption to hide its logic, though the encryption key was embedded in the file itself, making it recoverable through static analysis.
Once executed, the malware acts as an information stealer targeting a wide range of sensitive data. It targets browsers including Chrome, Edge, Firefox, Brave, and Opera, extracting passwords, cookies, and autofill data. It also targets crypto wallets such as Exodus, Ledger Live, and Monero; password managers including Bitwarden, 1Password, and KeePass; and messaging platforms like Telegram and Discord. The malware additionally harvests SSH keys, AWS credentials, Docker configuration files, and other developer-related credentials.
The stolen data is compressed using zlib and exfiltrated to a command-and-control server. Rather than hardcoding the server address directly, the malware decrypts the location using credentials obtained from a YouTube channel and GitHub gist, though the address was also present as a fallback in the binary itself. The infrastructure was registered on September 14, 2026, with the malware distributed on torrents by October 8, 2026.
The developer emphasized that while Sonarr cannot execute files, users running the software on systems with shared access face risk if others inadvertently launch the malware. Recommended mitigations include configuring qBittorrent to refuse downloading executable files, blocklisting malicious releases in Sonarr, and removing or demoting trackers that repeatedly distribute such content.
Key facts
- Malware was disguised as a South Park episode and distributed via public torrent trackers with over 2,392 seeders
- The executable contained 118 KB of actual code padded with 886 MB of random data to evade antivirus detection
- The malware targets credentials from at least 8 browsers, 11 crypto wallets, 6 password managers, and various messaging and development tools
- The malware uses ChaCha20 and AES-CTR encryption, though the decryption keys are embedded in the executable
- Command-and-control infrastructure was registered on September 14, 2026, with torrents distributed by October 8, 2026