The Elder Scrolls IV: Oblivion
The Elder Scrolls V: Skyrim
The Elder Scrolls: Online
Fallout: New Vegas
Fallout 4
Fallout 76
Mount & Blade: Warband
Mount & Blade II: Bannerlord
Kenshi
The Witcher 3: Wild Hunt
Cyberpunk 2077
Kingdom Come: Deliverance
Minecraft
Crusader Kings 2
Crusader Kings 3
Hearts of Iron IV
Stellaris
Cities: Skylines
Cities: Skylines II
Prison Architect
RimWorld
Euro Truck Simulator 2
American Truck Simulator
Microsoft Flight Simulator 2020
Farming Simulator 17
Farming Simulator 19
Spintires и Spintires: MudRunner
BeamNG.drive
My Summer Car
My Winter Car
OMSI 2
Grand Theft Auto: V
Red Dead Redemption 2
Mafia 2
Stormworks: Build and Rescue
Atomic Heart
Hogwarts Legacy
You click a low-quality streaming link, a torrent magnet, or a "Play" button on an illegal sports stream. Behind the main window, a second tab opens. The top of the tab shows a smiling lion stock photo (sunny, savannah background). The page claims your "Flash Player is out of date" or "You need to install a codec."
If you’ve recently found yourself staring at a browser tab you didn’t open—specifically one with a bright, oddly cheerful lion and the word “Xmovi” in the URL—you’re not alone.
Is this a new streaming service? A piece of adware? A phishing domain? After digging through user logs and domain registries, here is everything you need to know. Because "Sunny Lion" is a generic stock photo subject and "Xmovi" is a common typo for "XMovies," this term likely points to one of two scenarios: Scenario A: The Adware Pop-Up (Most Likely) Multiple users report that "Sunny Lion" appears as a banner image on pop-under tabs generated by browser hijackers. These tabs usually have a URL structure like xmovi.[something].xyz or sunny-lion.xmovi-tv[.]com .
Over the past six months, a fragmented but persistent series of user reports has surfaced across Reddit, BleepingComputer, and tech support forums. The search term doesn't lead to a single website, but rather a constellation of symptoms.
If you see that sunny lion, do not pet it. Close the tab, clear your cache, and consider installing an ad-blocker (like uBlock Origin) to prevent the malvertising chain that leads to it in the first place.
Run a full scan with Malwarebytes or Windows Defender immediately. Check your browser for new extensions you didn't install.
Stay safe out there, and remember: No legitimate video player requires you to "update your codec" via a pop-up tab. Share your experience in the comments below—including the exact URL you saw—to help others identify new variants.