MalwarePublished 19 Aug 2025Updated 18 Sep 2025

Noodlophile Stealer Evolves: Targeted Copyright Phishing Hits Enterprises with Social Media Footprints

Source AlienVault OTX General

Description

The Noodlophile Stealer, first detailed in our previous analysis (New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms), has evolved into a highly targeted threat exploiting enterprises with significant Facebook footprints.

Impact

For European organizations, the Noodlophile Stealer poses a significant risk to confidentiality and integrity of corporate data. Enterprises with active Facebook profiles or social media marketing teams are particularly vulnerable to targeted phishing campaigns that exploit publicly available information to craft convincing lures. Successful infections can lead to credential theft, unauthorized access to internal systems, and potential data breaches. The use of DLL sideloading and process injection complicates detection and remediation efforts, potentially allowing attackers to maintain long-term access. This can disrupt business operations, damage reputations, and result in regulatory penalties under GDPR if personal data is compromised. Additionally, the malware’s persistence and stealth capabilities increase the risk of lateral movement within networks, potentially affecting critical infrastructure and sensitive projects. Given the medium severity rating and the targeted nature of the attacks, organizations involved in sectors such as finance, technology, media, and government are at heightened risk. The threat also underscores the importance of securing social media channels and educating employees about sophisticated phishing tactics.

Defensive guidance

European enterprises should implement multi-layered defenses tailored to the specific tactics used by Noodlophile Stealer. First, conduct thorough social media footprint audits to identify and minimize publicly available information that could be used for reconnaissance. Implement advanced email filtering solutions with capabilities to detect spear phishing and malicious attachments, focusing on indicators related to copyright phishing themes. Employ application whitelisting and monitor for DLL sideloading behaviors using endpoint detection and response (EDR) tools capable of detecting T1073 techniques. Enhance process monitoring to identify anomalous process injection and command execution activities (T1055, T1059). Regularly update and patch systems, even though no specific patches are linked to this malware, to reduce the attack surface. Conduct targeted phishing awareness training emphasizing the risks of social media-based spear phishing. Restrict or monitor the use of Telegram and other encrypted messaging platforms within corporate environments to detect potential C2 communications. Finally, implement network segmentation and strict access controls to limit lateral movement if an infection occurs, and establish incident response plans specifically addressing advanced persistent threats with stealthy persistence mechanisms.

Indicators of compromise

URLs 6

http://15.235.172.219/vmeo/getlink?id=dcaathur
http://15.235.172.219/vmeo/link/dcaathur.txt
http://160.25.232.62/bee/BEE02_H.txt
http://160.25.232.62/vmeo/getlink?id=bee02h
http://196.251.84.144/suc/And_st.txt
http://196.251.84.144/suc/zk2.txt

IP addresses 3

15.235.172.219CC=SG ASN=AS16276 ovh sas
160.25.232.62CC=JP ASN=ASNone
196.251.84.144CC=NG ASN=ASNone

Hashes 21

a8b6c3b0cd1d36b7a6f94ccf676f6c75MD5 of d0b0551e8988a9f81b80933ec68efabb47cd12acaeffa79c42564863424a376e
4e6d0fd9824de4d27b0957953f6b5a32bcb74cd6SHA1 of d0b0551e8988a9f81b80933ec68efabb47cd12acaeffa79c42564863424a376e
0ba36c80167919a98cffc002cf6819d3f5e117207e901aebd13e3ea54387e51f
2e610c97e5bae10966811b78fc9e700117123b6a12953bf819ced9b25eb9a507
320555e241025b8427e1a3ccfc62f0c5a2347cfd86d29f33709192e2e9cbbac2
3c3cee4579e78c9d39b96804815c71c7a2de17951e08d703197c9c7ed20ab9f3
5ad456333451fcbd69977a62d4728b1fc8b5bdebee763d2b6725226078daeaf8
693789e4b9fb280fa32541e9a548b7fefd98775b8f075e370464db3764bb15b9
69d6582d7550817f792f3287fa91788e7b9252b63d81a380a5e1ca9aa0629150
707223112e8ced786e7d1ed43224e73606b3e2efec615bb3a22fe8cc11d3bb54

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 Aug 2025, 22:17 UTC

MITRE ATT&CK techniques5 from threat tags

Technical details

Indicators of compromise

URLs 6

IP addresses 3

Hashes 21

Community reviews

Related threats