Fake AI Tools Spread Noodlophile Malware, Targeting Crypto Wallets and Sensitive Data

Noodlophile Malware Exploits AI Hype

A sophisticated malware campaign is leveraging the growing interest in AI-powered tools to spread a dangerous information stealer called Noodlophile. Cybersecurity researchers at Morphisec have uncovered a scheme where threat actors create convincing AI-themed platforms to lure unsuspecting users into downloading malicious software 1

1

Social Media Spread and Targeting

The attackers are using legitimate-looking Facebook groups and viral social media campaigns to advertise their fake AI tools. Posts on these platforms have garnered significant attention, with a single post attracting over 62,000 views. The campaign specifically targets users seeking AI tools for video and image editing 1

1

Infection Mechanism

When users visit these fraudulent websites, they are prompted to upload images or videos for AI-generated content. Instead of receiving the promised AI-created material, victims unknowingly download a malicious ZIP archive named "VideoDreamAI.zip". This archive contains an executable file disguised as a video, which initiates a complex infection chain 2

2

Noodlophile Capabilities

Once deployed, Noodlophile exhibits powerful data-stealing capabilities:

1. Harvests browser credentials from major browsers including Chrome, Edge, Brave, and Opera
2. Extracts cryptocurrency wallet information
3. Gathers other sensitive data from the infected system 3

   3

In some instances, the malware is bundled with a remote access trojan called XWorm, granting attackers deeper control over the compromised devices 2

2

Data Exfiltration and Command Structure

The stolen information is transmitted in real-time to the attackers using a Telegram bot, which also serves as a command-and-control server for the malware. This setup allows hackers immediate access to the exfiltrated data 4

4

Related Stories

Fake AI Image Generator Scam Spreads Malware, Targeting Content Creators and Businesses

Cybercriminals Exploit AI Hype: Malicious Facebook Ads Target Millions

Cybercriminals Exploit AI Hype to Spread Ransomware and Malware

Russian Hacking Group FIN7 Exploits AI Nude Generator Trend to Spread Malware

Origin and Broader Context

Researchers suspect that Noodlophile originates from Vietnam, based on a GitHub profile claiming to be a "passionate Malware Developer from Vietnam." This aligns with observations of a thriving cybercrime ecosystem in Southeast Asia, particularly focused on distributing stealer malware through Facebook 1

1

Protective Measures

To safeguard against such threats, cybersecurity experts recommend:

1. Using caution when downloading files from unfamiliar websites
2. Verifying file extensions before executing downloads
3. Enabling file extension visibility in Windows
4. Utilizing malware scanners to check downloads before opening
5. Keeping operating systems and antivirus software up-to-date 3

   3

   4

   4

This campaign underscores the evolving tactics of cybercriminals, who are quick to exploit public interest in emerging technologies like AI to distribute malware and compromise user security.