MalwarePublished 12 May 2025Updated 11 Jun 2025

New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms

Source AlienVault OTX General

Description

As artificial intelligence (AI) surges into mainstream adoption, millions of users turn daily to AI-powered tools for content creation—from generating art and music to transforming photos into videos. But amid this excitement, cybercriminals have uncovered a potent new lure: fake AI platforms promising cutting-edge content generation in exchange for user uploads.

Impact

For European organizations, the Noodlophile stealer poses a significant risk to data confidentiality and operational security. The malware's credential theft capabilities can lead to unauthorized access to corporate networks, cloud services, and sensitive databases, potentially resulting in data breaches and intellectual property theft. Remote access features enable attackers to maintain long-term persistence, facilitating espionage or further lateral movement within networks. The use of fake AI platforms as a delivery mechanism exploits current user interest in AI tools, increasing the likelihood of successful infections, especially among employees in creative, marketing, and IT departments who frequently engage with content generation software. The worm-like propagation could allow rapid spread within organizational networks, amplifying the impact. Additionally, compromised credentials could be used to launch phishing campaigns or distribute malware internally, exacerbating the threat. The impact extends beyond individual organizations to critical infrastructure and service providers in Europe, where disruption or data loss could have cascading effects. Given the malware's reliance on social engineering and popular platforms, awareness and user vigilance are critical to mitigating risk.

Defensive guidance

European organizations should implement targeted measures beyond standard cybersecurity hygiene. First, conduct focused user awareness training emphasizing the risks of interacting with unverified AI content generation platforms and the dangers of opening unsolicited Word documents or links, especially those promising AI capabilities. Deploy advanced endpoint detection and response (EDR) solutions capable of identifying process injection and masquerading techniques typical of Noodlophile. Network monitoring should include anomaly detection for unusual outbound connections indicative of data exfiltration. Enforce strict application whitelisting to prevent unauthorized execution of Python scripts or unknown binaries. Multi-factor authentication (MFA) must be mandated for all critical systems to mitigate the impact of credential theft. Regularly audit and limit privileges to reduce the attack surface for lateral movement. Organizations should also verify the legitimacy of AI tools before adoption, preferring established vendors and official platforms. Incident response plans should be updated to include scenarios involving AI-themed social engineering attacks. Finally, collaboration with threat intelligence sharing communities can provide early warnings and indicators of compromise related to Noodlophile.

Summary

The Noodlophile stealer is a newly identified malware strain that leverages the growing popularity of AI-powered content creation tools to distribute itself. Cybercriminals have created fake AI video generation platforms that promise users advanced content generation capabilities, such as transforming photos into videos or generating art and music. These platforms act as lures to entice users into uploading files or interacting with malicious content. Once engaged, the malware deploys an infostealer component designed to harvest sensitive information, including credentials, from the victim's system. The malware exhibits worm-like propagation capabilities, potentially spreading across networks or devices without user intervention. It also incorporates remote access functionalities, allowing attackers to maintain persistence and control over compromised systems. The infection vector often involves social engineering tactics, such as delivering malicious Word documents or leveraging popular social media platforms like Facebook to distribute payloads. The malware is implemented in Python and uses various techniques to evade detection, including process injection (T1055) and masquerading (T1036). Network communication is established covertly to exfiltrate stolen data (T1041), and the malware may abuse system services (T1503) and credentials stored in browsers or other applications (T1539). Although no known exploits are currently reported in the wild, the threat is active and evolving, targeting users attracted by AI content creation trends. The medium severity rating reflects the malware's capability to compromise confidentiality and integrity, combined with moderate ease of exploitation through social engineering and fake platforms.

Indicators of compromise

URLs 9

http://103.232.54.13:25902
http://160.25.232.62/bee/bee02_ads.txt
http://lumalabs-dream.com/VideoLumaAI.zip
https://85.209.87.207/sysdi/LDXC10.txt
https://85.209.87.207/sysdi/randomuser2025.txt
https://85.209.87.207/sysdi/randomuser2025.txt.
https://luma-aidreammachine.com/Creation_Luma.zip
https://luma-dreammachine.com/File_Successful.zip
https://luma-dreammachine.com/LumaAI.zip

Hashes 22

f9baac5f7aef86ee1e331bd9cf004969MD5 of 18c14dcfb9a54c5359026a5fcbdb3e4ba6ced2628a9cd9ae589baedbb29beaa6
fb6ae9cb662361d7ad1b58a4b03fe6e3c84e53baSHA1 of 18c14dcfb9a54c5359026a5fcbdb3e4ba6ced2628a9cd9ae589baedbb29beaa6
11c873cee11fd1d183351c9cdf233cf9b29e28f5e71267c2cb1f373a564c6a73
18c14dcfb9a54c5359026a5fcbdb3e4ba6ced2628a9cd9ae589baedbb29beaa6
286076a09f524cc7015f23fb63515b3a30cee070fbc13fbb6f8e9cb1e5ced2ce
32174d8ab67ab0d9a8f82b58ccd13ff7bc44795cca146e61278c60a362cd9e15
353f17553a3457c6b77c4ca30505d9307dda9613e2a98ad3e392d2084284b739
5c98553c45c9e86bf161c7b5060bd40ba5f4f11d5672ce36cd2f30e8c7016424
67779bf7a2fa8838793b31a886125e157f4659cda9f2a491d9a7acb4defbfdf5
6c32460510925289421d1c7af986e00e9ada459f56a423d8b65d6cc57ed053c7

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Jul 2025, 08:47 UTC

MITRE ATT&CK techniques6 from threat tags

Technical details

Indicators of compromise

URLs 9

Hashes 22

Community reviews

Related threats