Noodlophile: The Stealer Hiding Behind Fake AI Video Tools

Noodlophile is a Windows information stealer first documented by Morphisec in May 2025. Its defining trait is distribution: rather than cracked software or email alone, it was seeded through fake generative-AI video and image generator websites — impersonating tools such as Luma Dream Machine and CapCut — advertised in Facebook groups aimed at creators and small businesses. Victims upload a prompt expecting an AI-generated video and instead receive a ZIP whose contents execute a multi-stage loader ending in a Python-based stealer that exfiltrates via a Telegram bot. Some infections also drop the XWorm RAT.

Overview & Attribution

The developer is assessed to be of Vietnamese origin, based on a self-describing GitHub profile, language indicators and active promotion of the malware in Facebook groups — present this as an assessment, not a confirmed identity. There is no verified public price or formal MaaS tier; describe it as developer-operated. A GitHub account tied to the developer was created in March 2025.

The Fake-AI-Tool Lure

• Fake AI generator sites impersonate Luma Dream Machine, CapCut and similar, promoted via Facebook groups and pages; Morphisec reported group posts reaching up to around 62,000 views (a post-view figure, not infections). T1566.002
• The victim submits an image or prompt and receives a ZIP; the payload is disguised with a double extension such as Video_DreamMachineAI.mp4.exe. T1036.007 T1204.002
• The chain abuses a legitimate CapCut binary to load a .NET loader, which pulls a Python payload from a remote host; a batch script orchestrates it, and files self-delete to erase traces. T1059.006 T1070.004

What It Steals

• Browser credentials and saved passwords, session cookies and cryptocurrency wallet data. T1555.003 T1539
• Optional second stage: the XWorm RAT for broader remote access (treat XWorm as a separate bundled RAT).
• An August 2025 code analysis showed keylogging, screenshots and browser-history extraction being added but not yet active — emerging, not confirmed features.

2025 Evolution & Telegram C2

MITRE ATT&CK Mapping

Detection & Mitigation

• Block or inspect outbound traffic to api.telegram.org from processes that are not sanctioned messaging apps, especially scripting interpreters.
• Train users that free AI video and image generator sites advertised on Facebook are a current high-risk lure, and never to run a downloaded file claiming to be a video (watch for double extensions).
• EDR: flag a CapCut or other legitimate binary spawning .NET loaders and Python payloads from user-writable directories, and batch-then-self-delete sequences; do not treat a signed file as safe (the campaign abused certificates).
• On infection, rotate browser credentials and revoke Facebook and business-manager sessions, and hunt for XWorm persistence. Brief marketing and social-media teams, the August 2025 spear-phishing targets.