The torrent was titled as .mkv (normal and expected) but the actual file was .lnk (not normal)... so you would have had to open a weird random .lnk file to activate the trojan?
I wonder if an automated setup would play it without caring about the extension. If someone had something like Sonarr dropping episodes on a Plex drive, for example.
I believe the torrent included both an .mkv and a malicious .lnk file.
.lnk files are dangerous because they can evade detection and automatically open other files or executable on a computer; AFAIK you would not have had to open the .lnk file yourself.
HBO also noticed this bonus episode through its anti-piracy partner Marketly and took action in response. A takedown notice posted in the Lumen Database shows that the company asked Google to remove an “infringing” link to the non-existent release earlier this week.
They’re claiming to own the copyright to the Trojan horse?
"Takedown notice" has legal meaning, it's not some random cease-and-desist letter that you can draft for anything you want and that has no legal weight other than that it might be scary.