Target Industry
Indiscriminate
Overview
A new cyber threat is emerging where threat actors are creating fake artificial intelligence (AI) tools to lure users into downloading malware. The malware, named Noodlophile, is designed to steal sensitive information such as browser credentials and cryptocurrency wallet data. These fake tools are advertised through legitimate-looking Facebook groups and viral social media campaigns.
Impact
The impact of the Noodlophile Stealer malware campaign is high. Noodlophile malware can lead to significant data theft, financial losses, system compromise, and erosion of trust in online AI tools and platforms.
Exploitation
Threat actors are exploiting the Noodlophile Stealer malware through a sophisticated multi-stage attack. They create convincing fake AI tool websites and use Facebook ads to lure users who are interested in AI. These users are tricked into downloading a ZIP file, believing it contains a legitimate AI tool. However, the ZIP file includes a malicious executable that, once run, installs the Noodlophile Stealer malware on their system.
This malware then installs additional components, such as remote access tools, and begins stealing sensitive information like browser credentials and cryptocurrency wallets. The attackers can remotely control the infected system, further compromising its security.
Containment, Mitigations & Remediations
To mitigate the risks associated with the Noodlophile Stealer malware, organisations should implement a robust cyber security strategy. This includes educating staff about the dangers of downloading tools from unverified sources and the social engineering tactics employed by cybercriminals. Deploying reputable antivirus and anti-malware software is essential to detect and block malicious files.
Regular updates to operating systems, browsers, and security software are crucial to protect against vulnerabilities. Encouraging the use of strong, unique passwords and enabling two-factor authentication can further enhance security. Additionally, organisations should ensure regular data backups to prevent loss in case of a malware attack and advise caution when downloading files from unknown or suspicious websites.
Indicators of Compromise
The Indicators of Compromise (IoCs) for the Noodlophile Stealer malware campaign include:
- VideoDreamAI.zip: a malicious ZIP file
- MachineAI.mp4.exe: an executable file with a deceptive name
- A hidden folder called 5.0.0.1886: containing:
- CapCut.exe (a wrapper for embedded .NET malware)
- AICore.dll (a command execution helper)
- Document.docx (a batch script)
- Document.pdf (a password-protected archive)
- srchost.exe: a python payload containing the Noodlophile Stealer and the XWorm loader.
Threat Landscape
The Hacker News reported that a single post regarding these AI tools managed to gain over 62,000 views. The malware poses a substantial risk due to the threat actors using sophisticated social engineering tactics and targeting a broad audience interested in AI, making it highly effective at spreading.
Threat Group
The developer behind the Noodlophile Stealer malware is thought to be of Vietnamese origin. On their GitHub profile, which was created in March 2025, they claim to be a “passionate Malware Developer from Vietnam”.
Further Information
