Fake downloads of The Odyssey have begun spreading Lumma Stealer malware through files disguised as high-quality movie releases, putting crypto wallets, passwords, and browser sessions at risk.

Bitdefender reported on Aug. 6 that its researchers had found malicious Windows executables using filenames designed to resemble pirated copies of The Odyssey, only days after the film’s release.

The Odyssey downloads conceal Windows executables

Disguised as video files, the downloads use familiar torrent labels such as 1080p, WEBRip, Blu-ray, and H264 to make the listings appear authentic. Bitdefender identified filenames including “the odyssey 2160phd (2026) engsubs eztv.exe,” “the odyssey 2026 1080p h264-djt.exe,” and “the odyssey 2026 1080p webrip-lama.exe.”

Rather than opening a movie, each .exe file launches software built to infect a Windows computer. Bitdefender said its security products prevented users from downloading or running the detected files, although the researchers warned that other filenames may also be circulating.

Attackers can make the disguise harder to spot by changing the executable’s icon to resemble VLC Media Player or an ordinary video file. Windows installations hide known file extensions by default, according to Bitdefender, which means a user may see a movie-style name and VLC icon without noticing the .exe ending.

People searching torrent sites may also expect unusual filenames, compressed folders, or a bundled video player, giving the malicious file another layer of cover. Bitdefender said the lure does not require a complex trick because the victim has already decided to download an unofficial copy from an unverified source.

Lumma Stealer can capture wallets and browser sessions

Once executed, Lumma Stealer searches the infected computer for browser passwords, saved payment information, autofill records, remote desktop credentials, and cryptocurrency wallet data, according to the security firm.

The malware also collects browser authentication cookies. Bitdefender warned that stolen cookies can let an attacker take over an active account session even when the victim has enabled multi-factor authentication, since the criminal may reuse a session that has already passed the login check.

Known as LummaC2, the malware is an information stealer developed in Russia and sold to other criminals as a service, according to Bitdefender and U.S. authorities. Its availability through underground markets allows buyers to run data-theft campaigns without building their own malware.

During its examination of the Odyssey files, Bitdefender observed attempts to contact command-and-control infrastructure associated with Lumma Stealer. Researchers identified the domains auditva[.]cyou, myroayy[.]cyou and logmabx[.]click, which the company said it had blocked for its customers.

Unlike some earlier versions, the samples found in the latest movie campaign did not use separate droppers or persistence tools, Bitdefender said. The operators instead appeared satisfied with collecting and sending available information during the initial execution.

Previous movie-based Lumma attacks used extra methods to avoid detection. Bitdefender found delayed execution when security software was present, encrypted payload delivery through AutoIt scripts, and other checks in a 2025 campaign built around fake copies of Mission: Impossible – The Final Reckoning.

U.S. agencies previously disrupted LummaC2 infrastructure

For U.S. crypto holders, LummaC2 has already drawn action from federal law enforcement. In May 2025, the Justice Department obtained warrants to seize five internet domains used by the malware’s administrators, while Microsoft filed a separate civil case covering about 2,300 other domains tied to the operation.

Court documents cited by the department said the FBI had identified at least 1.7 million cases in which LummaC2 was used to steal information. Listed targets included browser records, email and bank login details, autofill data, and crypto seed phrases that could provide access to virtual asset wallets.

“Malware like LummaC2 is deployed to steal sensitive information such as user login credentials from millions of victims in order to facilitate a host of crimes, including fraudulent bank transfers and cryptocurrency theft,” Matthew Galeotti, then-head of the Justice Department’s Criminal Division, said in the announcement.

The federal operation seized two domains on May 19, 2025. After LummaC2 administrators told customers about three replacement domains the next day, U.S. authorities seized the new addresses as well, according to the department.

Alongside the seizures, the Cybersecurity and Infrastructure Security Agency and the FBI issued a technical advisory describing how LummaC2 enters computers and removes sensitive information. The Justice Department directed people who believe a device has been compromised to contact the FBI’s Internet Crime Complaint Center or a local field office.

The appearance of new Lumma-linked domains in Bitdefender’s 2026 findings indicates that malware campaigns using the family continued after the 2025 enforcement operation. Bitdefender did not provide a victim count, estimated crypto loss, or geographic breakdown for the Odyssey campaign.

Crypto malware is using familiar content as bait

Movie torrents are one part of a series of malware campaigns that package harmful code inside content, applications, or tools that users actively seek.

Earlier in August, crypto.news reported that Microsoft had found a fake CAPTCHA campaign using BNB Chain smart contracts to retrieve attack instructions. Microsoft said the operation targeted thousands of consumer and business devices each day and delivered several malware families, including Lumma Stealer.

Instead of downloading a movie, people caught in that campaign were instructed to open Windows Run, Terminal, or PowerShell and paste a command supplied by the attacker. Microsoft warned that successful infections could expose credentials, install remote-access tools, and create an entry point for ransomware.

Mobile users have faced a different form of wallet theft. In July, reports renewed attention around SparkKitty mobile malware, which Kaspersky had previously found inside iOS, Android, and third-party applications. The spyware collected images from phone galleries, where some users had stored screenshots of wallet recovery phrases, passwords, and QR codes.

Developer tools have also become a delivery route. Socket disclosed in May that the TrapDoor malware campaign involved at least 34 harmful packages and 384 connected versions across npm, PyPI, and Rust repositories. According to the security company, the packages targeted crypto and artificial intelligence developers while seeking wallet data, GitHub tokens, cloud credentials, and SSH keys.

For the latest movie campaign, Bitdefender advised users to watch films through legitimate streaming services, avoid executables advertised as videos, and keep Windows and security software updated. The company also recommended enabling file extensions in Windows Explorer so an .exe file cannot appear to be an ordinary movie.

US-based crypto exchange ABFinance, founded by ByBit’s former CEO Helen Liu, closed its doors last week before it ever opened.

ABFinance announced last Friday that the exchange’s planned launch will no longer go forward and that it is “winding down in an orderly manner.”

ABFinance lasted six months

Liu founded the exchange in March before stepping down from her ByBit co-CEO role on April 30, 2026. 

After ABFinance’s closure, Liu thanked her team and said: “It’s difficult to see this chapter come to an end.”

Over the last six weeks, BitMart, BitMEX, and AscendEX have also announced that they will be closing shop. 

The approach rested on simple logic. If cosmic radiation were truly driving cancer among air crew, the signal should appear specifically in the cancers that radiation is known to cause (breast, prostate, melanoma, and certain leukemias), and the signal should not appear in cancers like colon cancer that aren’t caused by this type of radiation. We would also expect to see higher rates of radiation-associated cancers among other types of workers exposed to radiation, like nuclear technologists. Meanwhile, unless something about aviation other than flying was associated with these cancers, we wouldn’t expect to see higher rates in aviation workers who remain on the ground, like aircraft mechanics and assemblers.

The pattern was hard to miss. Among all 503 occupations, flight attendants and pilots had the highest and second-highest share of deaths from radiation-related cancers—6.9% and 6.7%, respectively, after accounting for differences in age, sex, and other factors—a proportion that exceeded that of nuclear technologists. For cancers unrelated to radiation, aircrew sat near the middle of the pack. And our comparison groups fell exactly where the radiation hypothesis predicted; nuclear technologists ranked near the top, while ground-based aviation workers did not.

Cryptocurrency broker Bits of Gold said personal data belonging to roughly 200,000 customers was stolen by hackers, the company reported.

The Tel Aviv, Israel-based company reported the security breach on Sunday, saying a hacker gained unauthorized access to a third-party data analytics network and,gained access to customers’ names, national ID numbers, emails, phone numbers, IP addresses, bank account details, and public wallet addresses.

“Upon detection of the incident, we blocked access and disconnected the system from the information sources, so this access ended,” the company stated.

Bits of Gold said no funds, private keys, passwords, CVV codes, or scanned ID documents were exposed. The broker said its initial findings indicate the attack was part of a broader global incident that hit other companies simultaneously.

It is the third data breach reported within the crypto industry in the last week. Data from nearly 40,000 SafePal users was stolen on Sunday after a third-party vendor suffered a security breach. In a similar attack, personal data from almost 14,000 Trezor wallet customers was exposed on August 13 after its fulfillment partner, ShipMonk, was compromised.

Hardware wallets are somewhere in between a paper wallet and a browser-based hot wallet. They’re harder to hack than software, harder to lose than paper, but they’re not infallible. They can be lost or stolen, and users need to be able to trust the device to create their keys properly in the first place.

“Air-gapped systems help, but they are not a perfect fix,” Bobby Gray, founder of TEXITcoin, told CoinDesk. “Security has to begin with how the keys are generated and continue through every part of the custody process.”

This is, unfortunately, where things went wrong for Coinkite, the maker of the Coldcard wallet.

A bug in the system

In March 2016, the Toronto-based bitcoin company told customers it was sunsetting its hosted hot wallet. Running an online financial services company had brought persistent floods of junk internet traffic aimed at knocking their services offline, along with mounting legal costs and regulatory complications.

Instead, Coinkite said it wanted to try something different. It wanted to build decentralized hardware and “software-not-as-a-service.” That was early in crypto’s history, before Bitcoin’s second halving, when one entire bitcoin was trading slightly above the $400 mark.

Coinkite’s pivot first produced Opendime in April 2016. The small USB stick generated and concealed a private key, allowing bitcoin to be passed from one person to another like a physical bearer instrument. Physically breaking the device’s seal revealed the key and allowed the funds to be spent.

Tom Lee’s Bitmine Immersion Technologies, an Ethereum treasury company, resumed its Ether purchases last week, bringing it closer to a key business target of owning 5% of the second-biggest cryptocurrency’s supply despite challenging market conditions.

The company disclosed Monday that it acquired 9,926 Ether (ETH) during the week ending Aug. 16, bringing its total holdings to roughly 5.82 million ETH, or about 4.8% of Ethereum’s circulating supply. At an ETH reference price of $1,893, Bitmine’s Ether holdings were valued at roughly $11 billion. However, much of the company’s ETH was acquired at significantly higher prices.

Ether’s price was little changed on Monday, sitting just above $1,900.

The latest purchase puts Bitmine within striking distance of its long-term “Alchemy of 5%” target of holding 5% of the total ETH supply.

Bitmine’s conviction has been tested by a prolonged bear market for Ether, which has sharply eroded the value of its digital asset treasury. The company is sitting on more than $8.4 billion in unrealized losses on its ETH holdings, according to industry data.

With a portfolio value of more than $11 billion, BitMine’s unrealized losses are around 43%. Source: DropsTab

Still, Bitmine has continued accumulating Ether, making purchases every week since launching its ETH treasury strategy in June 2025.

Related: Ethereum devs to narrow 66 proposals tied to Hegotá upgrade

Bitmine’s staked Ether approaches $10 billion in value

Although Bitmine is sitting on large unrealized losses on its Ether holdings, its staking operations continue to generate yield. The company said it is staking more than 5 million ETH, worth roughly $9.6 billion at current prices.

That staking has enabled Bitmine to earn protocol rewards for helping secure the Ethereum network, providing a predictable source of yield regardless of short-term ETH price movements. Based on a seven-day staking yield of 2.61%, Bitmine projects annualized staking rewards of roughly $287 million, according to Lee.

Related: Crypto Biz: Bitcoin’s $116M self-custody wake-up call