DiCaprio Torrent Campaign Evolves: AgentTesla Delivered via Malicious Subtitles

The Evolution of a Social Engineering Trap

The cybercriminal playbook for exploiting popular culture has received a significant update. Following earlier campaigns that masqueraded as torrents for Oscar-nominated films, threat actors have now pivoted to target one of 2025's most anticipated blockbusters: 'One Battle After Another,' starring Leonardo DiCaprio. This new wave represents a dangerous escalation in both sophistication and targeting, moving from niche 'Oscar bait' audiences to the massive, mainstream fanbase of a major action film. Security researchers are tracking a global infection chain that delivers the potent AgentTesla information stealer through a clever multi-stage process, with weaponized subtitle files emerging as a critical component of the attack.

Attack Chain: From Torrent to Total Compromise

The infection begins on torrent indexing sites and forums where users seek early or pirated copies of the film. Attackers upload a malicious torrent file that appears legitimate, often with convincing file sizes, seed/peer counts, and user comments. Once downloaded and executed, the initial payload is not the malware itself, but a PowerShell script. This script acts as a downloader, designed to be lightweight and evasive. Its primary function is to retrieve the next stage from a remote command-and-control (C2) server.

This is where the campaign introduces a novel twist. The subsequent stage frequently involves malicious subtitle files (with the .SRT extension). Subtitles are a trusted file type, rarely scanned with high suspicion by security software or end-users. The PowerShell script downloads and executes these subtitle files, which contain obfuscated code designed to download and deploy the final payload: AgentTesla.

AgentTesla: The Endgame Payload

The deployment of AgentTesla marks the successful conclusion of the attack. This mature, commercially available malware is a formidable information stealer. Once installed on a victim's Windows system, it initiates a comprehensive data harvesting operation:

• Credential Theft: It scrapes saved passwords, cookies, and autofill data from a wide array of web browsers including Chrome, Firefox, Edge, and Brave.
• System Espionage: The malware activates keylogging to capture every keystroke, takes periodic screenshots, and extracts data from installed email clients like Outlook and Thunderbird.
• Financial & Crypto Targeting: It specifically hunts for cryptocurrency wallet information and credentials for financial platforms.
• Persistence & Exfiltration: AgentTesla establishes persistence mechanisms to survive reboots and stealthily transmits all stolen data to attacker-controlled servers.

Technical Analysis & Evasion Techniques

The campaign employs several techniques to avoid detection. The use of PowerShell, a legitimate administrative tool, allows initial execution to blend in with normal system activity. The multi-stage process, separating the downloader from the final payload, makes static analysis of the initial torrent file less effective. Obfuscation within the subtitle files and the use of dynamic C2 infrastructure further complicate defensive efforts. This modular approach indicates a level of planning beyond simple, opportunistic malware drops.

Impact and Recommendations for the Cybersecurity Community

The impact of this campaign is assessed as HIGH. It successfully combines high-potency malware with exceptionally effective social engineering. By leveraging a global cinematic event, attackers guarantee a large pool of potential victims motivated by curiosity and impatience, often leading to lowered security guardrails.

Recommendations for Organizations and Individuals:

1. User Education is Paramount: Security awareness programs must highlight the risks of pirated software and media, emphasizing that executable files (.exe, .scr, .ps1) and even seemingly inert files like .SRT from untrusted sources are extreme threats.
2. Endpoint Detection & Response (EDR): Deploy EDR solutions capable of detecting suspicious PowerShell behavior, such as scripts making network connections to download and execute further code.
3. Application Control: Implement policies, such as Windows Defender Application Control, to restrict the execution of PowerShell scripts and unauthorized executables, especially on non-administrative workstations.
4. Network Monitoring: Monitor outbound connections for traffic to unknown or suspicious IP addresses, a common indicator of AgentTesla and similar stealers exfiltrating data.
5. Threat Intelligence: Subscribe to feeds that provide indicators of compromise (IOCs) related to AgentTesla and its associated infrastructure to block known malicious domains and IPs at the network perimeter.

Conclusion

The 'One Battle After Another' campaign is a stark reminder that cybercriminal tactics evolve in tandem with popular trends. The shift from Oscar-focused lures to mainstream blockbusters, coupled with the innovative abuse of subtitle files, demonstrates attackers' continuous refinement of their social engineering and technical delivery methods. For cybersecurity professionals, this underscores the need for layered defenses that combine technical controls with ongoing user education about the ever-changing landscape of digital threats. The allure of free content remains one of the most potent weapons in the attacker's arsenal.