Warning to Filipinos hooked on piracy sites: MP4 downloads may contain malware

Filipinos who regularly download pirated movies, television shows and other video content from torrent sites and other untrusted sources are being warned to be more careful as cybersecurity researchers uncovered a technique that disguises malicious payloads as MP4 video files.

The warning is particularly relevant in the Philippines where 48 percent of consumers surveyed continue to access pirated video content, according to the 2026 consumer survey of the Asia Video Industry Association’s Coalition Against Piracy (AVIA-CAP) in partnership with YouGov. The Philippines remains among the markets with the highest piracy incidence in Asia-Pacific, behind Vietnam at 56 percent, Indonesia at 51 percent and Malaysia at 49 percent. (Asia Video Industry Association)

Security researchers from Censys discovered a malware campaign using files that appear to be MP4 videos but are actually containers carrying encrypted malicious code. The files can potentially pass basic file-type checks even though they cannot be played as normal videos.

The discovery raises concern for users who download content from piracy websites, torrent platforms and unknown file-sharing sources where there is little assurance that a downloaded file actually contains what it claims.

Censys, however, did not establish that this particular malware campaign was distributed through torrent or piracy sites. Researchers were unable to capture the initial lure used to compromise victims.

The attack chain downloads what appears to be an MP4 file. Instead of containing a legitimate video, the file carries encrypted and compressed PowerShell data hidden inside the MP4 container structure.

The payload eventually installs NetSupport Manager, a legitimate remote monitoring and administration tool used by information technology teams. Cybercriminals can abuse the same software to maintain access and remotely control compromised devices.

Censys identified 18 distinct builds spread across 40 live endpoints, six autonomous systems and four countries. Researchers said the delivery infrastructure appeared to have been established on August 21, 2026, with some hostnames placed behind Cloudflare.

The cybersecurity threat surrounding piracy goes beyond the fake MP4 campaign.

A separate AVIA-CAP study released in June found that nearly half of tested illicit streaming applications contained malware, while piracy services could also expose consumers to credential theft, fraud and other cybersecurity risks. (Asia Video Industry Association)

Despite those risks, the 2026 AVIA-CAP survey found that only 40 percent of respondents across the region identified cybersecurity threats as a consequence of piracy, suggesting many consumers still see piracy primarily as a way to obtain free content rather than a potential security threat. (Asia Video Industry Association)

For Filipino users, the warning is simple: avoid pirated downloads and be suspicious of websites that ask users to open Windows Run, PowerShell or Command Prompt and paste commands supposedly required to download, verify or play a movie.

A free movie may cost more than a subscription. That MP4 you downloaded may not even be a movie at all.