Noodlophile Malware Campaign: AI Video Scam & Stealthy Data Theft on Windows

Enticing users with the promise of AI-powered video creation, cybercriminals have launched a new campaign distributing a previously undocumented malware family, Noodlophile, strategically camouflaged as cutting-edge video generation tools. This campaign uses the allure of widely hyped artificial intelligence technology, specifically targeting users interested in AI-generated multimedia, and capitalizes on their curiosity with a well-engineered infection chain. The sophistication and scope of this attack reveal a dangerous evolution in the malware ecosystem—one that merges effective social engineering with advanced multistage exploits, and which may set the tone for future cyber threats on Windows platforms.

The Bait: Fake AI Video Generators Go Viral​

The attack begins on social platforms, particularly Facebook, where malicious actors purchase high-visibility ad placements to promote sites with names like “Dream Machine.” These services purportedly offer rapid, AI-driven video synthesis based on user-uploaded files—a service with legitimate appeal amid the current boom in generative AI.
However, unlike genuine AI media creators such as Runway or Pika Labs, these sites mask their true intentions. Once a user uploads a file, the site delivers a ZIP archive supposedly containing the requested AI-generated video. The reality is tragic for unsuspecting users: within the ZIP lies an executable (often titled in a way that intentionally blends in, such as Video Dream MachineAI.mp4.exe). This file masquerades as a standard MP4, leveraging Windows’ default behavior of hiding known file extensions—turning basic digital hygiene missteps into disaster.

Multi-Stage Infection: Blending Legitimate Tools and Stealth​

Upon execution, the malicious file reveals more of the campaign’s sophistication. Rather than deploying a traditional dropper or obviously suspicious binary, the file is a 32-bit C++ application, signed with a certificate generated through Winauth. Critically, it’s actually a repackaged version of CapCut, a popular and trusted video editing program (version 445.0). This repackaging allows it to smoothly pass initial user scrutiny as well as some security checks, benefiting from the “halo effect” of recognized software.
This initial loader serves as the launchpad for a carefully choreographed infection routine:

• A batch script (install.bat) is launched from a misleading directory structure (e.g., inside a folder named “Document.docx”).
• This script leverages certutil.exe, a legitimate Windows tool, to decode and extract a deliberately obfuscated, password-protected RAR archive, which is disguised as a PDF.
• Persistence is established via a new Registry key.
• The next-stage executable (srchost.exe) downloads and runs an obfuscated Python script (randomuser2025.txt) from a hardcoded remote server.

Depending on the system’s security posture, the malware chooses its injection strategy. On systems equipped with Avast antivirus, process hollowing is used to embed the payload into RegAsm.exe, a legitimate .NET utility—highlighting the attackers’ awareness of endpoint protection mechanisms. If Avast isn’t present, an alternative shellcode injection strategy leads to in-memory execution of the core payload, minimizing file system artifacts and increasing resilience against detection.

The Threat: Noodlophile Stealer Arrives​

Previously untracked in public malware intelligence feeds, Noodlophile distinguishes itself with a multi-pronged attack profile. According to analysis by Morphisec, it combines:

• Harvesting of browser-stored account credentials, cookies, and tokens
• Exfiltration of cryptocurrency wallet data
• Optional deployment of remote access tools (notably, bundling with XWorm RAT in some samples)
• Real-time data exfiltration to Telegram bots, which serve as command-and-control (C2) endpoints

This approach enables threat actors to siphon off both personal and financial assets, and—by integrating seamless remote access—build groundwork for further lateral movement or persistent campaigns on compromised networks.

The Malware-as-a-Service Link​

Researchers tracking this campaign have found Noodlophile being marketed on dark web forums, sometimes as part of “Get Cookie + Pass” service bundles and regularly promoted by Vietnamese-speaking operators. This aligns with a broader industry shift toward Malware-as-a-Service (MaaS), where toolkits, RaaS panels, and customer support are packaged for even low-skilled criminals.
Such commercialized malware distribution pipelines lower entry barriers and accelerate the proliferation of new threats. MaaS not only increases attack frequency but guarantees rapid iteration—making fresh variants harder to recognize and block by traditional signature-based antivirus solutions.

Critical Analysis: Evolution of Social Engineering and Supply Chain Deception​

The Dream Machine/Noodlophile campaign stands out not only for its technical depth but for its masterful social engineering. Three factors make this threat particularly potent:

1. Exploiting AI Hype​

With mainstream coverage of AI breakthroughs at a fever pitch, users are primed to trust sites purporting to offer “AI video synthesis” or similar buzzword-laden services. This taps into a real, widespread desire for creative tools, especially among younger, tech-literate, but sometimes security-naive demographics.

2. File Type and Certificate Deception​

By blending the executable with familiar media file extensions and signing it with a seemingly valid certificate, attackers skirt simple user awareness and certain antivirus heuristics. Windows’ tendency to hide file extensions by default massively compounds this risk.

3. Supply Chain Impersonation​

Packaging a malicious executable as a repurposed CapCut installer leverages brand familiarity. It’s not merely “trojanizing” software but repurposing genuine (unaltered) binaries to act as the visible component, while the malicious payload works in parallel via side-loaded scripts and staged downloads. This also demonstrates robust knowledge of digital certificate ecosystems and user trust patterns.

Notable Strengths of the Campaign​

• Polished Front-End Social Engineering: Professional ads, convincing AI branding, and smooth onboarding lure even careful users.
• Evasion of AV Solutions: The use of legitimate software, code signing, and in-memory execution allow the malware to bypass many detection mechanisms.
• Adaptive Execution Strategies: Detection of installed security solutions (like Avast) and altering the infection method demonstrates up-to-date threat actor know-how.
• Real-Time Data Dunk: By exfiltrating via Telegram bots, data transfer is seamless and hard to trace, leveraging encrypted messaging infrastructure for criminal gains.
• Modularity: Optional bundling with RATs like XWorm gives flexibility—enabling both smash-and-grab credential theft and persistent, full-system compromise.

Risks to Windows Users and Organizations​

The appearance of Noodlophile exemplifies the growing peril of generative AI-related scams across the Windows landscape. Specific risks include:

• Credential compromise with potential for follow-up identity fraud, business email compromise (BEC), and credential stuffing attacks
• Cryptocurrency wallet theft, capitalizing on browser and extension vulnerabilities linked to crypto storage
• Corporate network penetration if a compromised system belongs to a connected workplace, especially one without strict endpoint controls
• Potential lateral movement in conjunction with remote access trojans, opening avenues for ransomware deployment or data exfiltration at organizational scale

Defenses: Staying Safe Amid Smart Social Engineering​

Mitigation against such threats hinges on layered defensive strategies:

• Always reveal file extensions in Windows Explorer, especially when handling downloads from unfamiliar sources. This basic setting (Control Panel → Folder Options → View → Uncheck “Hide extensions for known file types”) can immediately thwart the “.mp4.exe” trick.
• Strictly avoid downloading executables from unverified sites, especially those promoted through social ads or unsolicited DMs.
• Maintain a robust, up-to-date security suite with real-time behavioral detection as well as heuristic analysis. Signature-based AV alone may not recognize the latest malware strains.
• Educate users about the latest social engineering ploys, emphasizing AI-related scams and supply chain impersonation. Phishing and fake-software download campaigns remain the top vectors for malware introduction, but their sophistication is rapidly increasing.
• Monitor network behavior for anomalous outbound connections, especially to Telegram or similar messaging platforms, which might indicate stealthy C2 channels.
• Utilize application whitelisting and user access restrictions, limiting the ability to execute unknown binaries and install new software, notably on business endpoints.

Looking Ahead: A Template for the Next Generation of Malware​

The rapid appearance of Noodlophile reveals the agility of modern cybercriminals in leveraging social trends, technical exploits, and global communication channels simultaneously.
This campaign should serve as a wake-up call—especially for Windows users, small businesses, and educational institutions—demonstrating both the necessity of applying digital skepticism and the importance of technical hardening. The malware’s blend of browser theft, lateral RAT deployment, and Telegram-based exfiltration means the risks go far beyond individual losses, threatening broader ecosystems and reputational damages.
As the AI boom continues, so too will the creative exploitation of its hype cycle. Future attacks may leverage even more convincing deepfakes, cross-platform payloads, or wider-ranging data harvesting. Organizations that proactively blend technical controls with ongoing user education will be best positioned to thwart such complex, ever-evolving threats.
To conclude, the Noodlophile infostealer and its stealthy distribution via fake AI video generators mark an inflection point in cybercrime strategy—where psychological manipulation, software supply chain impersonation, and real-time cloud exfiltration converge. Recognizing these signs, fortifying technical and social defenses, and maintaining a healthy skepticism toward the latest online trends are the new imperatives for staying secure in the Windows ecosystem.

---

Source: BleepingComputer Fake AI video generators drop new Noodlophile infostealer malware