Bonus’ Episode of ‘House of the Dragon’ Comes With a Nasty Surprise for Pirates

"House of the Dragon" is one of the most watched TV series, particularly among pirates. The second season ended earlier this month after the eighth episode, though many fans had hoped for more. Pirates who downloaded the unexpected 'House of the Dragon S02E09' release got a surprise bonus, but not the one they were hoping for.

“Game of Thrones” and its prequel “House of the Dragon” have proven very popular in pirate circles.

The fact that episodes repeatedly leaked before their official premieres made them even more appealing.

This summer, HBO released the second season of House of the Dragon, and the series is already confirmed for a third. To the disappointment of some, however, there were no leaks this year. Or were there?

After the eighth and final episode was released in early August, there was some online banter about a ninth episode. Many people shared their visions of a hypothetical follow-up episode, enough to confuse those who were not up to speed on the inside jokes.

House of the Dragon S02E09

On pirate sites, meanwhile, confusion had also set in. As it turns out, House of the Dragon S02E09 had been uploaded to several reputable torrent sites; masquerading as the real deal, it came with an evil twist.
TorrentFreak spoke to one person who spotted the ‘episode’ in their list of torrents. The release ‘House.of.the.Dragon.S02E09.1080p.WEB.h264-ETHEL.mkv‘ came from a torrent site and was added through an RSS feed monitored by FlexGet.

On a superficial level the release mimics a genuine release. For example, the file size matched expectations and since the torrent originated from TorrentGalaxy, the source didn’t raise any red flags either.

The massive giveaway for hardcore House of the Dragon fans, of course, is that a ninth episode doesn’t exist. For others not yet completely up to speed on the length of the season, the glaring ‘error’ may simply pass them by. And it’s not difficult to accept that some people may be inclined to download and open the release regardless, which comes with something extra: a .LNK file.

Compromised LNK
Files with an LNK extension are pointers used by Windows to quickly open a file, folder, or application. When maliciously configured, which was indeed the case with this particular torrent, the .LNK triggered a Trojan horse disguised as a Dragon. That’s not something anyone wants on their computer.

Antivirus vendor McAfee previously warned about a rise in LNK files being used to spread malware. The small files seem harmless but can trigger other programs to run, inviting malware to penetrate the operating system with potentially disastrous results.

A quick glance at one of the VirusTotal scans for fake TV show torrents is self-explanatory. Antivirus vendors don’t all agree on what it is, but a “Fragtor” trojan is repeatedly mentioned.

The fake House of the Dragon torrent was spread across multiple sites, and there are also equally fishy alternatives. This includes ‘House.of.the.Dragon.S02E09.720p.WEB.H264-NHTFS.mkv‘, which also comes with an LNK file.

Torrent Sites and HBO Respond


The person who ‘caught’ the torrent in their RSS feed didn’t fall for the scam. They also noticed that the rogue file had already been deleted by TorrentGalaxy. This makes sense, as the site typically deals with these malicious uploads relatively quickly.

In response to this and similar uploads, we’re informed that TorrentGalaxy has banned LNK files from being added to torrents. That should prevent this attack vector from being abused going forward, at least on that site.

Interestingly, HBO also noticed this bonus episode through its anti-piracy partner Marketly and took action in response. A takedown notice posted in the Lumen Database shows that the company asked Google to remove an “infringing” link to the non-existent release earlier this week.

HBO likely didn’t remove the torrent because it contained malware. The naming of the file must have triggered the anti-piracy filters, even though a ninth episode doesn’t exist.

Pirates are Popular Malware Prey
These types of malware torrents, disguised as pirated TV episodes, are not uncommon. In recent weeks, several others have appeared online, targeting other series as well. This makes sense, as pirates are popular prey.

Popular TV series are downloaded millions of times. Scammers take advantage by spreading malware disguised as new episodes, or even non-existent ones, hoping that people will fall for it.

At the time of writing, the fake 1080p release of House of the Dragon S02E09 is still being actively shared by roughly two dozen people. In total, it has been downloaded many hundreds, or even thousands of times.

While well-moderated torrent sites tend to remove these files quickly, they continue to float around elsewhere. And indeed, the aforementioned malware copies of House of the Dragon are still available on some sites today.

In the past, we have criticized some reports from rights holders that seemed to exaggerate the malware problems on pirate sites. However, the fact that these threats are sometimes blown out of proportion doesn’t mean that there are no issues at all. Pirates have always been a popular target for malware and viruses.

While hardcore pirates have probably learned to be cautious, people who randomly start searching for pirated content online can easily walk into malware traps.