Torrent poisoning is the abuse of torrent ecosystems to distribute malicious files or links. Attackers seed fake media packages, renamed executables, or poisoned torrent listings that look legitimate enough to attract downloads. Because torrent networks are decentralized and user-trusted, a malicious upload can spread quickly through shared trackers, magnet links, and reposted filenames.
This matters in cyber security because the torrent layer often serves as the first stage of an infection chain. A poisoned download may install a loader, steal credentials, or fetch later-stage payloads after the user opens what appears to be a movie, game, or archive. Defenders look for suspicious file types disguised as media, mismatched hashes, unusual tracker activity, and endpoints that execute downloaded content. Safe habits include verifying hashes, using trusted sources, and treating executable files in torrent bundles as high risk.