Noodlophile Stealer: Malware Rides the AI Hype Wave Through Fake…

Threat actors are distributing the previously undocumented Noodlophile Stealer via bogus AI video-generation sites, luring victims to upload personal content and download a malicious payload disguised as a legitimate video file. The multi-stage infection chain abuses a repurposed CapCut binary, living-off-the-land binaries, .NET in-memory loading, and PE hollowing in RegAsm.exe, often dropping the XWorm RAT for persistent access. Morphisec documented the campaign, which is amplified through legitimate-looking Facebook groups garnering over 62,000 views per post.

Threat actors are distributing the previously undocumented Noodlophile Stealer through fake AI video-generation platforms, exploiting public enthusiasm for artificial intelligence as a social-engineering vector. The mechanism inverts the traditional push model: victims are induced to upload personal content and actively download malicious files, convinced they are receiving a legitimate product. The campaign, documented by Morphisec, serves as a case study in how the "upload your face, get a video" business model has become a perfect infection vehicle.

Key Takeaways

Noodlophile Stealer is a previously undocumented malware with capabilities to steal browser credentials, cryptocurrency wallets, and sensitive data
Fake AI video-generation platforms are advertised via legitimate-looking Facebook groups with over 62,000 views on individual posts
The infection chain spans multiple stages: C++ wrapper, .NET loader, batch, Python, and finally shellcode with PE hollowing in RegAsm.exe
In many cases, Noodlophile deployment is accompanied by XWorm, a remote access trojan that provides persistent control of the compromised system

How the Infection Funnel Works: From AI Promise to Payload

The initial vector stands out for inverting the traditional threat model. Instead of pushing malware to the victim, the system induces the user to pull the payload through an apparently legitimate interaction: photo upload, AI processing, download of the result. The psychology of active waiting makes the victim prone to bypass security warnings, having personally initiated the process.

The downloaded file is a ZIP archive named VideoDreamAI.zip, containing an executable with a masked name: "Video Dream MachineAI.mp4. .exe". Spaces hide the real .exe extension, a masquerading technique that exploits filename rendering in certain user interfaces.

The executable is a repurposed version of CapCut, a legitimate video-editing tool, version 445.0, signed with a certificate created via Winauth. CapCut.exe weighs approximately 140 MB, an abnormally large size that helps evade static scanners by resembling legitimate software. Inside it contains roughly 275 embedded PE files, primarily .NET assemblies, loaded in-memory via .NET runtime hosting APIs.

The Multi-Stage Chain: Multi-Layer Evasion

After initial execution, the C++ payload delegates to .NET components that orchestrate the in-memory loading of additional assemblies. The technique exploits the trust associated with a legitimate brand and in-memory execution to avoid writing easily detectable artifacts to disk.

An intermediate stage uses certutil.exe, a legitimate Windows LOLBin, to decode a file named Document.pdf into a RAR archive. The use of preinstalled system tools reduces the detection surface for EDR solutions that rely on indicators of known malicious tools.

The final Python payload includes Worm 5.2, with propagation mechanisms via shellcode loader and PE hollowing in RegAsm.exe. Persistence is achieved through a Run key registration. Exfiltration occurs via communication with a Telegram bot, a pattern documented in related malware across the threat landscape.

"Instead of relying on traditional phishing or cracked software sites, they build convincing AI-themed platforms—often advertised via legitimate-looking Facebook groups and viral social media campaigns" — Morphisec threat analysis

Recommended Actions

Organizations must treat unverified AI video-generation platforms as a specific shadow IT risk: block the domain and execution of ZIP files with masked double extensions exemplified by "Video Dream MachineAI.mp4. .exe".

Security teams should update EDR rules to detect abuse of certutil.exe in decoding PDF files into RAR archives, a technique documented in the Noodlophile chain. Monitor in-memory loading of .NET assemblies from abnormally large C++ binaries: the ~140 MB repurposed CapCut.exe and ~275 embedded PE files are measurable anomaly indicators.

Verify the presence of connections to Telegram bots from unauthorized processes, a confirmed exfiltration channel for Noodlophile Stealer. Check the Run key for entries associated with folders bearing the static name "5.0.0.1886", a hidden system attribute used for persistence.

Users must recognize that uploading personal photos to free AI platforms promising "generated video" is the documented vector of this campaign, amplified by 62,000+ views on individual Facebook posts.

Why This Matters

The dossier does not specify the exact nature of exfiltrated data beyond browser credentials, cryptocurrency wallets, and sensitive data. It does not document specific remedial measures taken by platform operators or law-enforcement interventions.

The source does not specify whether the Winauth certificate has been revoked, nor whether the identified fake platforms remain active. The exact start date of the Noodlophile campaign is unavailable, as are the precise victim count and affected geographic entities.

The Takeaway: When AI Hype Outpaces Verification

The designated target of these campaigns reveals a precise selection logic. Content creators, small businesses, and general users exploring free AI tools constitute a high-risk profile: less security-aware than technical users, inclined to install unknown software to "try out" AI. The upload-download mechanism exploits a cognitive asymmetry: the active user is less critical than the passive one.

For organizations, the emergence of this social-engineering category raises policy questions. Shadow IT applied to AI tools—the use of unapproved platforms for work tasks—expands the attack surface in ways traditional perimeter controls do not intercept. The perimeter shifts from the firewall to the user's browser, from email to the authenticated web session.

The documented technical chain—C++ wrapper, .NET runtime hosting, LOLBins, PE hollowing—is non-trivial. It requires development and testing skills not accessible to low-level opportunistic operators. This suggests the free AI tools market segment is perceived as sufficiently lucrative to justify significant technical investment.

Frequently Asked Questions

Does Noodlophile Stealer also spread via email?

The dossier documents distribution exclusively through fake AI video-generation web platforms and their promotion on Facebook groups. No email vector for Noodlophile emerges.

Does the Winauth certificate indicate CapCut itself is compromised?

No. The executable is a repurposed version of the legitimate software, signed with a certificate created via Winauth. The source does not document a compromise of the original vendor's infrastructure.

The exact relationship between the two malware families is not established in the dossier. They share technical patterns (Python, Telegram C2) but differ in injection vector, structure, and operational target. Attribution remains an open question.

Information is based on the cited source and current as of publication.

Sources

Sources and references