Noodlophile Stealer Reportedly Distributed Through Allegedly Fraudulent AI Content Platforms

Summary

A campaign reportedly used fake AI video generation sites to distribute malware under the guise of AI-generated content. Promoted via social media, these sites allegedly tricked users into downloading files containing Noodlophile Stealer, a previously unreported infostealer, and in some cases XWorm. The malware harvested credentials and could enable remote access.

Developers

• Noodlophile Stealer developers

Deployers

• Noodlophile Stealer developers
• Unknown actors operating fraudulent AI-themed websites
• Unknown actors distributing malware-as-a-service (MaaS)

Harmed parties

• Users whose devices were potentially compromised via remote access trojans (RATs)
• Targets of credential theft
• Small businesses targeted by Noodlophile Stealer
• Individuals targeted by Noodlophile Stealer

Tags

• malware campaign
• infostealer
• malware delivery
• social engineering
• remote access trojan
• malware-as-a-service
• credential theft
• wallet theft
• exfiltration
• stealth malware
• obfuscation
• fake AI image-to-video generator
• CapCut impersonation
• Dream Machine impersonation
• Telegram bot exfiltration
• Windows
• Python-based malware
• .NET loader
• PE hollowing
• shellcode injection
• Noodlophile Stealer
• XWorm
• Worm 5.2
• CapCutLoader
• Facebook
• fake websites
• whitespace extension spoofing