One Fake Movie Download Can Expose Passwords, Payments and Crypto Assets