Noodlophile malware distributed via fake AI content platforms
Cybercriminals created fraudulent AI content platforms impersonating legitimate services and promoted them on social media to distribute Noodlophile Stealer malware. The infostealer, linked to a Vietnamese developer, steals browser credentials and cryptocurrency wallet data, and sometimes installs remote access tools.
What happened
Attackers created convincing fake AI platforms impersonating legitimate services like CapCut AI and Dream Machine AI, promoted through Facebook groups and viral social media posts that received over 62,000 views. Users were lured to bogus websites with promises of AI-generated video and image editing, then prompted to upload content.
When users attempted to download their edited content, they received a malicious ZIP file containing disguised executable files such as 'Video Dream MachineAI.mp4.exe'. Running the file launched a chain of infections including the Noodlophile Stealer infostealer and in some cases the XWorm remote access trojan.
Reported impact
The Noodlophile Stealer malware steals browser credentials, cookies, and cryptocurrency wallet details. The XWorm remote access tool allows attackers to maintain long-term control over victims' systems.
Index analysis
Researchers from Morphisec discovered that attackers used realistic AI-themed platforms to target content creators and small businesses, bypassing traditional phishing tactics with convincing web interfaces. The malware was linked to a Vietnamese developer identifying as a 'passionate Malware Developer' on GitHub, and Vietnam has a known history of cybercrime activity targeting social media platforms.
Governance controls
Meta removed over 1,000 dangerous links in 2023 that exploited ChatGPT's popularity to spread malware, demonstrating prior efforts to address similar threats on its platform.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.