Scammers are using fake AI tools and Facebook ads to spread Noodlophile Stealer malware, targeting users with a multi-stage attack to steal credentials.
Cybersecurity researchers at Morphisec have identified a new malware campaign utilizing fake and malicious artificial intelligence (AI) platforms to distribute a new information stealer dubbed Noodlophile Stealer.
This sophisticated tactic exploits the surging popularity of AI tools to trick users into downloading malware that can steal browser credentials, and cryptocurrency wallets, and potentially deploy remote access tools like XWorm.
How Does it Work?
Morphisec’s threat analysis, shared with Hackread.com ahead of its publishing on 8 May 2025, details how cybercriminals are creating convincing fake AI websites, often advertised through Facebook groups with global reach (some posts exceeding 62,000 views on a single post).
These platforms lure users with promises of free AI video and image generation, prompting them to upload their own images. Instead of the expected AI-processed content, victims unknowingly download a malicious ZIP archive containing the Noodlophile Stealer.
Novel Social Engineering Leverages AI Trend
This campaign stands out due to its exploitation of AI as a social engineering lure, targeting a potentially more trusting audience of creators and small businesses exploring AI, mainly within Facebook communities.
Morphisec report notes that Noodlophile Stealer is a newly documented malware combining credential theft, wallet exfiltration, and optional remote access deployment. Notably, it exfiltrates stolen information through a Telegram bot.
Open-source intelligence (OSINT) investigations led Morphisec to identify the developer behind Noodlophile, likely of Vietnamese origin, who was observed promoting this method in Facebook posts and on online cybercrime marketplaces. The developer’s profile also reveals further involvement in malware sales and distribution, with links found in Facebook groups leading directly to their profile.
Multi-Stage Attack Designed for Evasion
The attack chain involves a multi-stage infection process designed for stealth and persistence. Users interacting with the fake AI site download a ZIP file (VideoDreamAI.zip) containing a deceptive executable (Video Dream MachineAI.mp4.exe), which is a repurposed version 445.0 of the legitimate video editing tool, CapCut, and is even signed using a certificate created via Winauth.
This executable then drops further malicious components from a hidden folder named 5.0.0.1886, including CapCut.exe (a wrapper for embedded .NET malware), AICore.dll (a command execution helper), and disguised files like Document.docx (a batch script) and Document.pdf (a password-protected archive).
The install.bat script, launched by CapCutLoader (within CapCut.exe, which first verifies internet connectivity by pinging google.com up to 10 times), decodes the archive (password: TONGDUCKIEMDEVELOPER2025), establishes persistence, and downloads and executes a Python payload (srchost.exe) containing the Noodlophile Stealer and the XWorm loader.
These final payloads operate in memory to evade detection, with the XWorm loader employing techniques like shellcode injection and PE hollowing (especially targeting RegAsm.exe if Avast is present).
The Noodlophile Stealer and its use of fake AI platforms is just another cybersecurity threat against unsuspected users. Therefore, one must remain cautious at all times, refrain from downloading tools directly from social media posts or third-party platforms, and always use official websites to download files.
Even after downloading a file from a verified source, do not execute/install the program on your device before scanning it on websites like VirusTotal or ANY.RUN.