Microsoft did not find that one million people were infected simply because they watched a movie. Its March 6, 2025 investigation found a global malvertising campaign that affected nearly one million devices and appeared to begin with advertisements and redirects embedded in unauthorized movie-streaming websites. The most serious compromise generally required a user to download and run a malicious file or script.
That distinction matters: “affected devices” is not the same as one million confirmed infections, people, or data-theft victims. But the campaign shows why illegal streaming sites can be a dangerous delivery channel for credential stealers, remote-access tools, and follow-on malware.
What Microsoft actually reported
Microsoft Threat Intelligence detected the campaign in early December 2024 and observed activity reaching devices around the world. The company associated the operation with Storm-0408, an umbrella name Microsoft uses for multiple actors involved in distributing remote-access and information-stealing malware through methods including phishing, search-engine optimization, and malvertising.
The suspected starting point was an advertisement placed inside a movie player or page iframe on an unauthorized streaming website. The advertisement could generate pay-per-view or pay-per-click income for the site operators while also directing visitors into a malicious chain of redirects.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall#1 Best Overall
- WHAT YOU GET: FixMeStick Virus Removal Tool for Apple Macs (Macs from 2006 to 2017. 2018 and later systems are not yet compatible. Special instructions required for FileVault. A minimum of 512 MB of RAM. Not compatible with Fusion Drive and RAID storage systems. Not compatible with Bluetooth mice or keyboards. Can’t decrypt files encrypted by ransomware.), Getting Started Guide, our virus removal guarantee backed by our friendly Canadian based Customer Support Team.
- EXPERT TECHNOLOGY ANYONE CAN USE: plug it in and the FixMeStick reboots your computer from a system on the stick to remove viruses that snuck past your antivirus software.
- REMOVES THE LATEST THREATS: The FixMeStick automatically updates its engines for up-to-the-second detection and removal of the latest threats.
- SAVE TIME: Save a trip to the repair store and run the FixMeStick once a month from the comfort and privacy of home. FixMeStick removes viruses, Trojans, rootkits, ransomware, or other malware lurking on your system.
- PEACE OF MIND: As Macs become more popular more hackers are creating viruses specifically targeting them. Feel confident and secure knowing your Mac is clean with the FixMeStick.
Microsoft’s report describes observed infrastructure and campaign impact. It does not establish that every affected device was infected, that every visitor ran malware, or that every user lost data.
How the streaming-site attack chain worked
The campaign commonly used four or five redirection layers. A typical sequence looked like this:
- Site visit: A user opened an unauthorized streaming page to watch a movie or television program.
- Malicious advertising or iframe: Code embedded in the page or video player redirected some traffic away from the expected content.
- Intermediate domains: The browser passed through several redirectors and intermediary pages. These could include technical-support-scam pages, malware-delivery pages, or pages pretending to offer a player, codec, browser update, or free-content service.
- Payload delivery: The victim was prompted to download an executable, script, archive, or supposed update.
- Execution and follow-on activity: If the downloaded file or script ran, it could establish an initial foothold and fetch additional components.
The crucial dividing line is between visiting a page and executing a downloaded payload. A malicious advertisement can expose a browser to redirects and scams without automatically giving an attacker full control of the computer. The documented chain became substantially more dangerous when a user accepted and ran the deceptive download.
Why GitHub, Discord, and Dropbox appeared in the chain
Microsoft observed initial-access payloads hosted primarily on GitHub. It also found one payload on Discord and another on Dropbox. These are legitimate services, but criminals can abuse legitimate hosting platforms because their domains may look familiar, their traffic can blend with ordinary activity, and their infrastructure can be created or replaced quickly.
Free tools Windows power users keep installed
One-click scans. No signup required.
Microsoft worked with GitHub to take down the repositories it identified. That disrupted the observed infrastructure, but it does not eliminate the broader technique. Attackers can create replacement repositories, move files to other legitimate platforms, or switch to infrastructure that has not yet been reported.
The presence of a malicious file on GitHub, Discord, or Dropbox does not mean those companies were responsible for the campaign or that every file hosted on those services is unsafe. The relevant question is what the file is, how it arrived, and whether the user was asked to execute it.
What malware was involved?
The initial files Microsoft observed acted as droppers: their purpose was to establish the first stage and bring down or launch later components. Those later stages included Lumma Stealer and an updated version of Doenerium, both associated with information theft. Some infections also deployed NetSupport, a remote monitoring and management tool that can provide attackers with additional control when misused.
The campaign used several scripting and execution mechanisms, including:
Recommended Free Tools
- PowerShell
- JavaScript
- VBScript
- AutoIT
- Legitimate Windows utilities such as
MSBuild.exeandRegAsm.exe
Using built-in tools does not make the activity legitimate. Abusing trusted Windows components can help malware execute while blending into normal system activity or avoiding simple file-based defenses.
What information could be at risk?
Microsoft observed behavior extending well beyond the initial download. Depending on the components deployed and the permissions available on the device, the malware could collect or inspect:
- System details: Operating-system information, memory size, graphics details, screen resolution, user paths, signed-in users, and installed applications.
- Browser data: Credential and profile files associated with Chrome, Edge, and Firefox, including login data, cookies, history-related files, and key material.
- Personal files: Content in locations such as OneDrive, Documents, and Downloads.
- Screenshots and browsing activity: Some components supported screenshot collection, browser remote debugging, or remote monitoring.
- Cryptocurrency-related information: The malware searched for software associated with Ledger Live, Trezor Suite, KeepKey, BCVault, OneKey, and BitBox.
The wallet checks indicate that cryptocurrency credentials and wallet-related data were potential targets. They do not prove that cryptocurrency was stolen from every affected user.
Microsoft also observed persistence mechanisms such as registry run keys, shortcuts in startup folders, and scheduled tasks. These allow malware to restart after a reboot. Some activity attempted to weaken protection by adding Windows Defender exclusion paths, making malicious files less likely to be scanned.
Why newly created certificates mattered
The campaign used newly created digital certificates to make first-stage malware appear more trustworthy. Microsoft said it had identified twelve such certificates by mid-January 2025 and that the discovered certificates had been revoked.
Revocation helps reduce reuse of those specific certificates, but it is not a permanent solution to the technique. Attackers can obtain or create new certificates and distribute new files. A certificate, download prompt, or familiar hosting domain should never be treated as proof that a file is safe.
Why unauthorized streaming sites are attractive to attackers
Unauthorized streaming sites draw users looking for current or hard-to-find movies and television programs without paying for a licensed service. Their advertising and redirection ecosystems can be opaque, rapidly changing, and difficult to distinguish from the intended video controls.
Rank #2
- WHAT YOU GET: FixMeStick Virus Removal Tool for Apple Macs (Macs from 2006 to 2017. 2018 and later systems are NOT compatible. Special instructions required for FileVault. A minimum of 512 MB of RAM. Not compatible with Fusion Drive and RAID storage systems. Not compatible with Bluetooth mice or keyboards. Can’t decrypt files encrypted by ransomware.), Getting Started Guide, our virus removal guarantee backed by our friendly Canadian based Customer Support Team.
- EXPERT TECHNOLOGY ANYONE CAN USE: plug it in and the FixMeStick reboots your computer from a system on the stick to remove viruses that snuck past your antivirus software.
- REMOVES THE LATEST THREATS: The FixMeStick automatically updates its engines for up-to-the-second detection and removal of the latest threats.
- SAVE TIME: Save a trip to the repair store and run the FixMeStick once a month from the comfort and privacy of home. FixMeStick removes viruses, Trojans, rootkits, ransomware, or other malware lurking on your system.
- PEACE OF MIND: As Macs become more popular more hackers are creating viruses specifically targeting them. Feel confident and secure knowing your Mac is clean with the FixMeStick.
Microsoft found malicious redirectors embedded within the streaming pages involved in this campaign. Separate research by Malwarebytes and DeepSee provides broader context, although it studied a different problem: advertising fraud rather than the Storm-0408 campaign. That investigation estimated 210,550,928 visits to the studied illegal movie and adult-streaming sites in January 2023 and projected approximately $120,000 to $1.2 million in advertiser spending that month under conservative assumptions.
Those figures should not be treated as measurements of Microsoft’s malware campaign. They illustrate why abusive streaming-ad ecosystems can be commercially significant and attractive to criminals.
This is also not a claim that every free streaming service is malicious. A licensed, ad-supported service is materially different from a site redistributing copyrighted content without permission. The security warning concerns unauthorized streaming sites and the advertising and redirect infrastructure associated with them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If you clicked a suspicious stream or downloaded a fake update
If you only opened a page and did not download or run anything, the risk is different from an executed malware infection. You should still close suspicious tabs, avoid returning to the site, and update your browser and operating system. If you downloaded and ran a file, or if the device is behaving strangely, treat the situation more seriously.
- Stop using the device for sensitive activity. Do not sign in to banking, email, cryptocurrency, cloud-storage, or work accounts from a computer that may be compromised.
- Use a known-clean device to protect accounts. Change important passwords, beginning with email and financial accounts. Use unique passwords rather than variations of the old one.
- Revoke active sessions. Review account-security pages and sign out other sessions wherever the service supports that option. Check for unfamiliar recovery addresses, MFA methods, forwarding rules, and newly added devices.
- Enable stronger MFA. Prefer a passkey or FIDO2 security key over SMS when the account supports it. Enroll the key before an incident and confirm that it works with each important service; compatibility and recovery options vary.
- Update through official channels. Install pending Windows and browser updates through Windows Update, the browser’s own settings, or the software vendor’s official website. Do not accept a “cleanup” or “browser update” offered by a pop-up.
- Run current security tools. Use up-to-date antivirus or endpoint-security software and allow it to complete a full scan. Do not disable protection because a website says that security software is blocking the video.
- Get help if a stealer or remote-access tool may have run. Professional incident-response assistance may be appropriate, particularly for a work computer, a device containing financial information, or a computer showing persistence or remote-control symptoms.
- Consider a reset or reinstall when warranted. Back up only essential personal files, taking care not to preserve suspicious executables or scripts. A reset can be appropriate, but it is not a substitute for changing exposed passwords, revoking sessions, checking accounts, or obtaining professional advice.
- Respond quickly to possible wallet or financial exposure. Contact the relevant bank, exchange, or wallet provider through its official support channel. Never enter a wallet recovery phrase into a website, unsolicited support chat, or “verification” form.
For organizations, Microsoft’s recommendations include tamper protection, network protection, web protection, endpoint detection and response in block mode, attack-surface-reduction rules, current software, and MFA—preferably phishing-resistant authentication. Consumer users should apply the same principles at a simpler level: keep protection enabled, update promptly, and make stolen passwords less useful by using unique credentials and phishing-resistant MFA.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why a FIDO2 security key can help
A FIDO2 security key is a small hardware authenticator that can provide phishing-resistant MFA for compatible accounts. Unlike a one-time code typed into a fake login page, the key verifies the legitimate website origin as part of the authentication process. It can therefore reduce the value of a stolen password.
It does not clean an infected computer, recover stolen data, or protect an account if it was never enrolled. Set up at least one backup sign-in method according to the service’s recovery rules, store the key securely, and verify support before buying.
Where a Windows cleanup tool fits—and where it does not
After an incident has been contained, Windows users may want help identifying potentially unwanted applications, tracking cookies, vulnerabilities, or system problems. Outbyte PC Repair describes features for scanning for potentially unwanted applications and some known malware, removing tracking cookies, identifying vulnerabilities, and repairing certain Windows issues.
That is a maintenance use case, not a guarantee of removing Lumma Stealer, Doenerium, NetSupport, or every persistence mechanism. Outbyte states that PC Repair complements antivirus software. It should not replace current endpoint protection, account recovery, professional incident response, or a reset when a credential-stealing infection is suspected.
The practical lesson
The danger was not simply that people watched movies online. The campaign used unauthorized streaming pages as an entry point into a layered advertising and redirect system, then relied on deceptive downloads and execution to establish a foothold. Legitimate hosting services were abused to deliver parts of the chain, and the resulting malware could target browser credentials, files, screenshots, system information, and cryptocurrency-related data.
Choosing licensed streaming sources removes this particular unauthorized-site risk, but no website is a substitute for basic security habits. Never run a codec or browser update supplied by a pop-up, keep Windows and browsers current, use a reputable security tool, and protect important accounts with unique passwords and phishing-resistant MFA.
Frequently Asked Questions
Did one million people get infected by free movie sites?
No. Microsoft reported that a malvertising campaign affected nearly one million devices. That number is not a count of confirmed human victims, confirmed infections, or confirmed data-theft cases.
Can simply visiting an illegal streaming site infect a Windows PC?
A page visit can expose a browser to malicious advertising and redirects, but the serious compromise Microsoft described generally involved downloading and executing a malicious file or script. A visit alone does not prove that the device was infected.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat should I do if I ran a fake video player or browser update?
Stop using the device for sensitive logins, change important passwords from a known-clean device, revoke active sessions, enable phishing-resistant MFA, update your software, and run current security tools. Seek professional help or consider a reset or reinstall if a credential stealer or remote-access tool may have executed.
Were GitHub, Discord, or Dropbox responsible?
No. Microsoft observed attackers abusing those legitimate platforms to host or deliver payloads. The companies themselves were not identified as responsible for the campaign.
Will a VPN protect me from this malware?
No. A VPN may provide certain network-privacy benefits, but it does not make a malicious download safe and does not prevent credential theft after malware executes.
The Bottom Line
Bottom line: The accurate headline is that nearly one million devices were affected by a malvertising campaign linked to unauthorized streaming websites—not that one million “pirates” were confirmed infected. The highest-risk moment was accepting and running a deceptive download. If that happened, protect accounts from a clean device, use phishing-resistant MFA, scan and update the computer, and get professional help when a stealer or remote-access tool may be involved.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
