Security researchers warn that a new malware campaign is using searches for the 2026 Best Picture nominees as bait — just days before the Oscars on March 15. The scheme hijacks Google results and fake streaming pages to trick viewers into installing malware instead of movie players, risking passwords, crypto and other account theft.

What happened and why it matters now

CyberNews uncovered a campaign it calls Efimer that specifically targets people looking for illegal downloads of this year’s Best Picture nominees ahead of the 98th Academy Awards on March 15, 2026. With many viewers rushing to catch up before the ceremony, the campaign widens its pool of potential victims at the worst possible moment.

Which films are being used as lures

Efimer has exploited the full slate of nominees — including Marty Supreme, Bugonia, Sinners, F1, Hamnet, Frankenstein, One Battle After Another, The Secret Agent, Sentimental Value and Train Dreams. Researchers found about 12.11% of Google results for these searches were malicious, and singled out Marty Supreme (16 malicious links), Bugonia (15) and Sinners (12) as the most-used lures.

How Efimer works

Rather than rely on torrents, attackers have weaponized SEO and compromised vulnerable WordPress sites to host fake torrent landing pages and “special player” downloads. As CyberNews put it, Efimer is “a classic honeypot.”

Victims who download the fake player actually install the Efimer script. The malware monitors the Windows clipboard and, when it detects a crypto transaction, swaps the recipient address with the attacker’s — effectively trying to “empty their digital wallets.”

Where you can watch the nominees legally

If you’re racing to watch before Oscars night, use legitimate platforms rather than risky search results. According to availability listings:

  • HBO Max: One Battle After Another, Sinners
  • Netflix: Frankenstein, Train Dreams
  • Peacock: Bugonia
  • Hulu: The Secret Agent; the Oscars ceremony itself will stream live on Hulu
  • Apple TV+: F1; Hamnet and other titles are available to rent or buy on Apple TV and Amazon Prime Video
  • Marty Supreme and several nominees are available to rent or purchase on platforms such as Amazon Prime Video and Apple TV

What fans and industry are saying

Industry and security observers are urging viewers to avoid illegal downloads and to rely on the official streaming or rental options listed above. With the awards broadcast on ABC and streaming on Hulu at 7 p.m. ET on March 15, many fans are expected to stream nominees this week — making safe viewing practices especially important.

How to protect yourself

  • Use official services or trusted rental stores rather than clicking unknown search results.
  • Never download a “special player” prompted by a site; use your device’s native player or the official app for the service.
  • Keep Windows, browsers and antivirus/firewall software up to date.
  • Be cautious with crypto transactions: Efimer replaces clipboard addresses, so double-check recipient addresses and consider using wallet apps with built-in protections.

What to expect next

With the Oscars imminent, security teams expect search-based baiting campaigns to spike. Viewers who want to catch up on nominees should plan to stream or rent through the legitimate platforms above and treat suspicious search results as high-risk. Organizers and platforms may also push reminders about safe viewing ahead of March 15.