Malware in torrents

How malware gets into torrents

BitTorrent checks that each piece you receive matches the torrent's hash. That proves you got the file the torrent describes. It says nothing about whether the file is what its name claims. Attackers create torrents with popular titles, seed them, and wait. The file arrives intact, exactly as the attacker built it.

Video files themselves don't run code. So attackers pack something that does: a program, a shortcut, a script, or an archive that contains one. They rely on people opening the first file they see.

What security researchers have found

The Digital Citizens Alliance is backed in part by creative industries, and its report is from 2015. Its findings are consistent with the security firms' later research above.

Common tricks

• Executables posing as video. Movie.mp4.exe, or a file with a video icon and an .exe or .scr extension. Kaspersky's advice: video files use formats like .avi, .mkv or .mp4, not .exe.
• Shortcut files. A .lnk file can run any command. In the 2025 Bitdefender case, it was named to look like the film's launcher.
• Booby-trapped subtitles and images. In the same case, the subtitle file held real subtitles plus code, an image file was really encoded program data, and the cover image was a password-protected archive.
• Odd archive formats. ARJ, password-protected ZIP or RAR files and self-extracting archives in a media torrent are warning signs.
• "Install this codec or player." A file that says you need special software to watch it is usually the malware.
• Fake download buttons. Piracy sites and their copies run ads that look like download buttons and lead to adware, fake updates or card-detail forms.
• Tampered clients. Download your torrent client only from its official site. The 2016 Transmission case shows even official sites can be compromised, so check signatures where published.

Warning signs before you open a torrent

1. Look at every file in the torrent Most clients show the file list before or during download. A film should be one or a few video files, maybe subtitles (.srt) and an image. Anything else needs a reason.
2. Turn on file extensions In Windows File Explorer, choose View > Show > File name extensions. A file called film.mp4.exe can't hide then.
3. Check the size and date A new film that's much smaller than expected, or available before its official release, is suspect. Kaspersky advises checking official release dates.
4. Scan before opening Run your security software on the downloaded folder.
5. Open video in a media player, not by double-clicking unknown files Open the player first, then choose the video file from inside it.

If you think you opened malware

1. Disconnect from the internet This can stop data being sent out or more malware being downloaded.
2. Run a full scan Use your security software's full or offline scan. Windows has Microsoft Defender Offline scan built in.
3. Change passwords from a clean device Stealers such as Lumma take saved browser passwords and session cookies. Change important passwords, starting with email and banking, and sign out of other sessions. A password manager makes this faster.
4. Watch your accounts Check bank and card statements, and turn on two-factor authentication where you can.
5. Consider a reinstall Remote access trojans can keep a foothold. If in doubt, back up your documents (not programs) and reinstall the operating system.

The simplest way to avoid torrent malware

Use legal sources that publish their own torrents, such as the Internet Archive, Linux projects and Academic Torrents, and verify downloads with the publisher's checksums. See legal torrent sources and the safe torrenting guide. For new films, legal streaming services remove the risk entirely.