CYPHERLOCK, INC.

Cybercriminals Exploit AI Craze with Deceptive Multimedia Platforms

With the surge in popularity of AI-driven content tools, threat actors are exploiting the trend by launching fake platforms that claim to offer next-gen video and image editing. These counterfeit services are not just misleading—they’re dangerous.

Promoted aggressively through viral content on social networks and large Facebook groups, these bogus platforms entice users to upload their personal files. Instead of delivering the promised features, they infect victims with a newly discovered strain of malware named Noodlophile Stealer.

This stealthy malware extracts browser-stored passwords, drains cryptocurrency wallets, and harvests other private information. It often acts as a gateway for more serious intrusions, deploying tools like the XWorm remote access trojan to seize greater control over compromised devices.

The Bait: AI Tools That Don’t Exist

A recent report by Morphisec, shared with Cyber Security News, highlights how the campaign cleverly manipulates the growing interest in AI productivity tools—particularly among digital creators and small businesses eager to streamline their workflows.

A New Breed of Deception: Fake AI Services Masquerading as Legitimate Tools

Moving beyond the usual phishing schemes and counterfeit software traps, cyber attackers are now building professional-looking websites that imitate real AI video generation platforms with alarming precision.

What sets this scheme apart is its delivery method: instead of relying on spam or malicious downloads, it uses viral social media engagement—especially on Facebook—as the primary weapon. In one striking example, a single promotional post attracted more than 62,000 views, rapidly funneling victims to these fraudulent platforms.

From Promise to Payload: How Fake AI Tools Turn Curiosity into Compromise

Visitors to these fraudulent AI sites are led to believe they’ll receive enhanced, AI-generated media after uploading personal images or videos. Instead, they’re deceived into downloading what’s presented as their customized content—a file that’s anything but safe.

This deceptive download, commonly delivered as a ZIP archive labeled VideoDreamAI.zip, conceals a malicious executable posing as a video file: Video Dream MachineAI.mp4.exe. The “.mp4” in the name is a trick to make the file appear harmless to the unsuspecting eye.

Under the hood, it’s a 32-bit C++ program disguised as a legitimate video editor—borrowing code from a real application like CapCut (version 445.0)—and even signed with a forged digital certificate to dodge antivirus scrutiny. Once launched, the fake tool silently kicks off a layered infection process, dropping the Noodlophile Stealer and, in more invasive cases, the XWorm remote access trojan.

Sophisticated Deception: Malware Hidden Behind Fake AI Video Platforms

What appears to be an ordinary online video editing service is, in reality, a front for a coordinated cyberattack. These bogus platforms pose as cutting-edge AI video tools but are actually delivery vehicles for a dangerous new malware strain.

Enter Noodlophile: A New Breed of Stealer

Noodlophile Stealer is an emerging threat previously unlisted in known malware databases. It merges several malicious capabilities into one lightweight but potent tool: hijacking browser-stored credentials, draining crypto wallets, and, when triggered, installing remote access trojans like XWorm for full-scale compromise.

Built with modular components and protected through layers of obfuscation, this malware is engineered for stealth. It quietly siphons off stolen data through Telegram bots, a tactic that bypasses many traditional monitoring tools.

OSINT analysis links the malware to active listings on underground cybercrime forums, where it’s being distributed as part of a malware-as-a-service (MaaS) kit. These kits often come bundled with support tools for account hijacking and credential harvesting. Linguistic markers and public social media activity suggest the creator is likely based in Vietnam and is promoting the malware in niche Facebook groups.

Anatomy of the Attack

The compromise begins innocently enough. Users visit a counterfeit AI site, upload their photos or videos, and are offered a “processed” file to download. Inside the downloaded ZIP archive is a disguised executable buried within a directory named 5.0.0.1886—a folder that houses the critical payload and support files for execution.

Once opened, the infection chain quietly begins, setting in motion credential theft, system exploitation, and data exfiltration—all under the guise of an AI editing experience.

Deep Dive: The Noodlophile Stealer Infection Blueprint

The attack powered by Noodlophile Stealer is anything but ordinary—it’s a sophisticated, multi-layered execution chain disguised behind the façade of legitimate AI software.

Key Components Behind the Curtain:

• CapCut.exe – A hefty 140MB executable masquerading as a video editing app. Built in C++, it silently embeds a .NET runtime used to inject and execute malicious code directly in memory—sidestepping static malware detectors. The file hides over 270 embedded .NET assemblies for modular payload execution.
• AICore.dll – A minimal but lethal helper file exporting a single function (cmdhelper) to run remote commands without tripping alarms.
• Document.pdf – Not what it seems. This decoy file is actually a password-locked RAR archive (Base64 encoded), camouflaged as a PDF and stuffed with weaponized Python scripts.
• Document.docx – A rogue batch script masked as a Word document. Its text is encoded using UTF-16 markers (FF FE) to obstruct automated scanning tools. Once renamed to install.bat, it becomes the infection’s command center.
• meta (images.exe) – A renamed WinRAR utility used to extract the booby-trapped archive—an innocuous name, deceptive purpose.

---

The Execution Chain Unfolded:

1. CapCut.exe activates and loads malicious .NET logic using an embedded bootstrapper called CapCutLoader.
2. The loader pings external services (e.g., google.com) to check connectivity, then renames the disguised files for execution.
3. install.bat fires up certutil.exe to decode Document.pdf, extracts the archive using a hardcoded password (TONGDUCKIEMDEVELOPER2025), and establishes persistence via Windows Registry edits.
4. A Python-based binary, srchost.exe, is fetched from an external server and executes the final stage: Noodlophile Stealer and, optionally, XWorm.

---

Advanced Evasion Techniques:

The final payload utilizes one of two stealthy injection techniques—either loading shellcode directly into memory or performing PE hollowing using RegAsm.exe, a trusted Windows binary. This ensures the malware lives in-memory and avoids leaving detectable traces on disk.

To further frustrate analysis, the attackers pack the campaign with:

• Base85 decoding
• Zlib compression
• Python marshal module execution

A decoy Python script, randomuser2025.txt, clogs reverse engineering attempts with 10,000 redundant operations, deliberately designed to crash or slow down automated analysis platforms.

---

Weaponizing AI Hype for Mass Impact

This operation is a case study in how cybercriminals are evolving—leveraging the public’s trust in AI innovation to spread advanced, modular malware to a broader, less security-conscious audience.

Noodlophile Stealer represents the new frontier in malware-as-a-service (MaaS): lightweight, adaptable, and devastating. By repackaging existing tools with deceptive wrappers and deploying them via convincing platforms, attackers are lowering the barrier for large-scale exploitation.

---

Protective Guidance:

• Stay skeptical of AI tools promoted through unofficial channels.
• Never trust downloadable files from unknown or unverified sources.
• Use endpoint protection solutions that detect fileless and memory-resident threats.
• Inspect file extensions closely—.mp4.exe is not a video.