← Saturday, October 17, 2026SecurityDeep dive

A fake South Park EXE kept Sonarr retrying an import

thereallo.dev 6 min read Editor score 6/10

A torrent with an episode-like name ending in .exe entered Sonarr’s queue, where failed imports retried every 90 seconds; qBittorrent reported completion despite zero bytes downloaded. The incident illustrates risks in automated media-ingestion workflows.

What

A fake South Park episode executable was uploaded to public trackers and repeatedly triggered Sonarr import attempts.

How

The 118 KB PE had 886 MB of junk appended; its footer held data used to decrypt a payload that was mapped into memory and run.

Why it matters

The incident shows that download pipelines can repeatedly process suspicious files even when the torrent reports completion but places no file on disk.

Read on thereallo.dev → Hacker News · 204 commentsLobsters · 3 comments

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.