A fake South Park episode on torrent sites was a 118 KB program wrapped in 886 MB of junk

A self-hoster who blogs as Thereallo found a new South Park episode stuck in his media server’s queue, and it wasn’t an episode at all. The file was named “South Park S29E03 1080p WEB H264-MeGusta.exe,” and he says it was on public trackers with 2,392 seeders. Sonarr, which grabs TV shows automatically, couldn’t import it, which is how he noticed.

He downloaded it again on purpose to see inside, and the size was the trick. The actual program was 118 KB, he wrote, and “the other 886 MB is random junk glued onto the end,” because, he says, a lot of scanners give up on files that big. The small program’s job was to find and decrypt a second program hidden in the junk.

That second program wants nearly everything on a Windows PC. His list covers passwords, cookies and autofill from seven browsers, crypto wallets, password managers including Bitwarden and 1Password, Discord tokens and Steam accounts, developer folders like .ssh and .aws, and the documents on your desktop. It even grabs your Sticky Notes, which baffled him.

The clever part fell apart once he looked. Instead of a hardcoded server, the malware fetches its address through a YouTube channel and a GitHub gist, then hardcodes that same address as a fallback anyway, he found. The domain was registered September 14, same day as the YouTube channel, and the torrent went up October 8.

Sonarr can’t run an .exe, so the risk is a person double-clicking it in the downloads folder: a roommate, a parent, or you at 3 a.m. If you use qBittorrent, he suggests adding *.exe, *.scr, *.lnk, *.bat and *.cmd to its “Excluded file names” so it refuses to download them, and a Hacker News commenter pointed to Sonarr’s “Fail Downloads” setting, where adding “Executables” marks these as failed and starts a new search.

A TV episode never arrives as an .exe file, so one sitting in your downloads folder goes in the trash unopened.