No Joker: Malware found in pirated Oscar-nominated movies

Joaquin Phoenix as Arthur Fleck acting out on a city bus.
(Image credit: Warner Bros. Entertainment Inc.)

Hey, have you seen the Joaquin Phoenix version of The Joker yet? He's craaaaazy!

And that's what you have to be if you try to download or stream the Joker movie for free from any number of illegal streaming sites, Kaspersky reported today (Feb. 6). 

Any site offering to stream the movie for free is probably going to be a phishing scam, and any movie file you're downloading for free is likely to be riddled (ha ha!) with malware.

On the other hand, Parasite, another Best Picture Oscar contender, is clean, despite its name. Kaspersky found no malicious "Parasite" files or streams.

Online crooks "always prey on something when it becomes a hot trend," said Kaspersky researcher Anton Ivanov. "To avoid being tricked by criminals, stick to legal streaming platforms and subscriptions to ensure you can enjoy a nice evening in front of the TV without having to worry about any threats."

If you're going to download movies from untrusted sources — and we don't recommend that you do — then make sure you are a) running one of the best antivirus programs, or one of the best Mac antivirus programs and b) scanning that downloaded file with said antivirus program before you open it. 

Kaspersky added a third tip, which is to make sure that the file has "an .avi, .mkv or .mp4 extension, or other video formats; definitely not .exe".

More than 300 fake Jokers

Overall, Kaspersky researchers found "more than 20" phishing websites that offered to stream you at least one of the nine Best Picture Oscar nominees, and 925 movie downloads that contained malware.  

The phishing sites asked you provide credit-card or personal details or fill out surveys, but none of them gave you the real movies at the end of the process. As for the file downloads, many will contain the real movie, but give you a little something extra as well. 

Screenshot of a pirated-movie streaming site.

(Image credit: Kaspersky)

Among all nine Best Picture Oscar nominees, Kaspersky researchers "found that Joker was the most popular film among cybercriminals with 304 malicious files named after the Gotham villain."

The World War I movie "1917 was second in this rating with 215 malicious files, and The Irishman was third with 179 files. Korean film Parasite did not have any malicious activity associated with it."

Sometimes it's easy to tell a free movie is fake. One Twitter account set up to promote free streams of The Irishman had this description of the Martin Scorsese gangster movie: "Sequel to the hit top imdb movie following four strangers who bond amid a postapocalyptic zombie outbreak." (That's the plot of Zombieland: Double Tap and probably a few other movies as well.) 

Screenshot of Twitter page offering free access to The Irishman.

(Image credit: Kaspersky)

Kaspersky also looked at the distribution over time of malicious file files, noticing spikes in Joker and 1917 fakes three weeks after each was released. 

The Irishman dipped two weeks after its release and stayed there, possibly because the movie soon became available on Netflix. Quentin Tarantino's Once Upon a Time ... in Hollywood saw an uptick four weeks after its release.

On the flip side, movies that didn't feature violent white men didn't have much appeal. The racing film Ford vs. Ferrari saw barely any interest, and Jojo Rabbit, Marriage Story and Little Women all flatlined. 

Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.

Latest in Malware & Adware
Green skull on smartphone screen.
Malicious Android apps with 60 million installs bombarding phones with ads and phishing attacks — how to stay safe
Malware
Dangerous new password-stealing trojan automatically reinstalls itself on infected PCs
An FBI agent typing on a computer
FBI issues warning to millions of Americans to avoid these websites that can steal your passwords and banking info
A hacker typing quickly on a keyboard
New MassJacker malware is hijacking digital wallets to steal large sums from users
A person trying to set up a new Wi-Fi router
Thousands of TP-Link routers have been infected by a botnet to spread malware
A smartphone screen displaying the Android name and logo next to a sign reading 'MALWARE'.
Fake Google Play Store pages are spreading Trojan malware that can steal your financial data
Latest in News
Apple Watch Series 10
Future Apple Watch models could get a surprising new feature — what we know
NYTimes Connections
NYT Connections today hints and answers — Monday, March 24 (#652)
NYT Strands on a cellphone
NYT Strands today — hints, spangram and answers for game #386 (Monday, March 24 2025)
iPhone 16 Pro vs iPhone 16 Pro Max in hand showing displays
Forget iPhone 17 — iPhone 18 could get this huge upgrade
The new Husqvarna iQ series robot lawn mower.
Husqvarna’s new robot mowers offer GPS for less
Rendered images of rumored foldable iPhone.
Foldable iPhone report just revealed key details — here's what we know