I dont know what is causing but i tried tons of fixes, i mainly use public torrenting, and sonarr and radarr are doing it.
I added *.arj and arj to the quality profile avoid list without success, and prowlarr is as torrent (i’ve read sometimes it gets confused and uses nzbget)
Everyone hasnt had this issue until recently.
Because it’s new vector for spreading malware that preys upon people running automated systems like the arr stack or just clicking stuff willy nilly.
The solution is to stop using public trackers that allow randos to upload malware.