FMovies Pirate Website Linked to Global Infostealer Activity

• What happened: The FMovies streaming website was linked to malvertising, cookie theft, and JS-injected ads.
• Why it matters: Visitors to the pirate website were exposed to Lumma, StealC, Vidar, Raccoon, and RedLine infections.
• Overall impact: Over 30,000 infostealer infections were linked to FMovies, and more than 10,000 leaked in the process.

The now-defunct FMovies piracy site, once the world’s most popular platform for illegal movie streaming, has been strongly linked to global infostealer activity impacting more than 15,000 users, according to a recent investigation. 

Findings on FMovies and Infostealers  

Data from Hudson Rock’s monitoring platform shows that over 32.2 million devices globally have been infected with infostealers, alongside 4.8 million compromised corporate accounts. 

Alarmingly, some infections originating from piracy-related vectors, like FMovies, remain undetected for extended periods, posing long-term risks to users and businesses alike.  

A recent report reveals that FMovies played a significant role in spreading infostealer malware, which siphons sensitive user data, including personal credentials, payment details, and session cookies. 

The Hudson Rock analysis reports 30,348 Lumma, StealC, Vidar, Raccoon, and RedLine infections impacting 15,286 users. In total, 10,000+ passwords were leaked, with only 12.9% labeled as strong.

The pirate website targeted cookies for session hijacking, bypassing MFA on weak sites, and free account access. Fake “Play now” or “Watch free” buttons were used to redirect to malware networks or droppers.

A large-scale malvertising campaign was seen in early December 2024 that Microsoft Threat Intelligence now believes infected one million devices for data theft. 

FMovies Shutdown  

The pirate website was dismantled in August 2024. In November, the FMovies operator confessed to the charges and faced prosecution, along with his accomplice. Meanwhile, in May, the indicted FMovies operators received suspended prison sentences.