GoKawiilMalicious .exe disguised as South Park episode spreads via torrent trackers, evades Sonarr blocklist checks
A user running the *arr media automation stack discovered that Sonarr had automatically grabbed a file posing as a South Park episode, which was actually an .exe with thousands of seeders on public torrent trackers. Analysis showed the file was padded with 886MB of junk data to evade antivirus scanners, with a genuine 118KB payload full of junk code designed to obstruct reverse-engineering in tools like IDA.