一位NAS用户发现，有人在公开种子网站上传了伪装为《South Park》剧集的恶意软件文件，被其Sonarr自动下载系统自动抓取1。该用户随后对恶意软件进行了逆向分析，发现其是一个功能完整的信息窃取程序1。
这款恶意软件能够窃取浏览器密码、加密钱包私钥、密码管理器凭证和多种账户信息，目标涵盖Chrome、Edge、Brave、Opera、Firefox等浏览器，以及Exodus、Electrum、Ledger Live等加密钱包应用，还包括KeePass、Bitwarden、1Password、Telegram、Discord和Steam等平台1。恶意文件体积约886 MB，其中仅含118 KB的实际恶意程序，其余为随机垃圾数据用于规避检测1。该文件在种子网站上拥有2,392个seeders1，上传时间为2026年10月8日（基于二进制编译时间为10月6日）1。
攻击者利用YouTube频道"bubblegym"（创建于2026年9月14日）和GitHub Gist作为命令控制服务器的中转站1。为防止类似感染，安全建议包括在qBittorrent中排除可执行文件类型（.exe/.scr/.lnk/.bat/*.cmd），在Sonarr和Radarr中添加恶意文件阻止列表，以及对持续提供恶意文件的追踪器进行降级或移除处理1。
A network-attached storage user discovered that malicious actors had uploaded compromised files disguised as South Park episodes to public torrent sites, which were then automatically downloaded by their Sonarr media server application.1 Upon reverse-engineering the malware, the user found a sophisticated information-stealing program capable of extracting browser passwords, cryptocurrency wallet credentials, password manager accounts, and various other login credentials.1 The malware employed YouTube channels and GitHub Gist pages as command-and-control relay servers.1
The malicious files, uploaded on October 8, 2026, according to the binary compilation timestamp of October 6, 2026, were seeded by approximately 2,392 users.1 Each file measured roughly 886 MB in total size, comprising only 118 KB of actual malicious code padded with 886 MB of random garbage data designed to evade detection systems.1 The attack targeted credentials across multiple applications including Chrome, Edge, Brave, Opera, and Firefox, as well as cryptocurrency wallets like Exodus, Electrum, and Ledger Live, password managers including KeePass, Bitwarden, and 1Password, and communication platforms such as Telegram, Discord, and Steam.1 The associated YouTube command-and-control channel "bubblegym" was created on September 14, 2026.1
The affected user recommended several countermeasures: configuring qBittorrent to exclude executable and script file extensions, adding blocklists to Sonarr and Radarr configurations, and either downgrading or removing torrent indexers from Prowlarr that continue to distribute the malicious files.1
评论
还没有评论，欢迎留下第一条。