Someone on Torrent Sites Kept Fucking with My Sonarr
Points and comments are a snapshot, not live.
Malware disguised as a South Park episode targeted Sonarr users with obfuscated credentials stealer.
A torrent file pretending to be a South Park EP (.exe) with 2,392 seeders was grabbed by Sonarr. The author reverse-engineered the 118 KB payload (with 886 MB junk). It uses ChaCha20 and AES-CTR to hide credential theft targeting browsers, crypto wallets, password managers, dev tools, and remote access apps. Stolen data is shipped via a server address decrypted from a YouTube channel or GitHub gist. The author recommends blocking *.exe, *.scr, *.lnk, *.bat, *.cmd in qBittorrent and removing such releases from Sonarr.
What commenters are saying
Commenters largely agree this is an old problem solved by filtering file extensions in the download client. Many recommend private trackers to avoid malware entirely, though some counter that public trackers suffice with proper exclusions. Ratios and invite systems on private trackers are seen as barriers by some, but others argue they are easy to maintain. A few point out Sonarr should handle this natively, linking to an unmerged PR.