Artificial intelligence has become a focal point of digital innovation, but it has also emerged as a new bait for cybercriminals. The recent discovery of the Noodlophile Stealer, as documented by Morphisec, demonstrates how attackers are exploiting the growing interest in AI-generated content to deliver sophisticated malware through fake AI video platforms. This article provides an in-depth technical breakdown of the attack chain, payloads, evasion techniques, and indicators of compromise (IoCs) associated with this ongoing campaign.
Infection Vector: Weaponized AI Hype
Cybercriminals behind Noodlophile are taking advantage of the excitement around AI tools for video and image generation. They craft convincing fake platforms promoted via social media, especially Facebook, where ads and posts claim to offer access to advanced AI video generators.
Victims are directed to download a ZIP archive containing an .exe file deceptively named to look like a video file (e.g., Video_Dream_MachineAI.mp4 .exe). The use of double extensions and whitespace tricks is designed to bypass superficial user inspection.
These landing pages are polished and professional-looking, reinforcing the illusion of a legitimate tool. Once the user downloads and executes the file, the infection chain begins.
Multi-Stage Dropper Architecture
The malware delivery is architected as a multi-stage payload system designed for stealth and persistence:
- Initial Binary (CapCut.exe): A large (140MB) C++ executable mimicking a known video editing app. It's a fake, signed executable that acts as a loader.
- Dynamic Link Library (AICore.dll): Exporting a method named cmdhelper, this DLL is loaded into memory to trigger script execution.
- Batch Script Execution: Inside the extracted ZIP, files with misleading names (e.g., Document.docx, meta.exe) are actually scripts or payloads. Document.docx is renamed to install.bat and executed.
- Payload Deployment via certutil: The batch script uses certutil.exe (a Windows living-off-the-land binary) to decode a base64-encoded archive, extract further components, and deploy a Python-based loader (srchost.exe).
- Persistence Mechanism: The batch script adds registry keys to HKCU\Software\Microsoft\Windows\CurrentVersion\Run to ensure execution on boot.
The ultimate objective is to deploy a dual payload comprising:
- Noodlophile Stealer: A stealthy information stealer that targets credentials, browser cookies, session tokens, crypto wallet data, and more.
- XWorm 5.2: A mature RAT (Remote Access Trojan) capable of command execution, file download/upload, keylogging, clipboard monitoring, and DDoS capabilities.
XWorm is injected into legitimate processes using process hollowing, specifically targeting RegAsm.exe, a signed Microsoft utility, to hide its execution.
Exfiltration via Telegram
One of the standout features of this campaign is its use of Telegram bots as a command-and-control (C2) and exfiltration channel. Once data is stolen, it is compressed and sent to pre-configured Telegram bot channels in real-time. This method bypasses many traditional perimeter defense tools that are not configured to inspect encrypted Telegram traffic.
Evasion and Anti-Analysis Tactics
The developers of the Noodlophile campaign exhibit a sophisticated understanding of modern defensive technologies and have implemented multiple layers of evasion to ensure successful delivery and execution of their payloads. One of the primary methods they use is the application of fake digital signatures. For instance, the initial CapCut.exe loader is deceptively signed using certificates generated via WinAuth. This superficial legitimacy allows the executable to evade basic signature verification checks that are often relied upon by users and some endpoint protection tools.
Another critical component of the evasion strategy is the use of living-off-the-land binaries (LOLBins). By leveraging native Windows tools such as certutil.exe and RegAsm.exe, the malware is able to perform complex operations like decoding encoded payloads or injecting code into legitimate processes, all without raising immediate suspicion. These binaries are typically whitelisted in enterprise environments, making them ideal for bypassing application control policies.
The attackers further enhance stealth through process hollowing, a technique in which malicious code is injected into the memory space of a legitimate process—in this case, RegAsm.exe.
Scripts used in the final stages of the infection chain are heavily obfuscated with layers of encoding such as Base85, compressed using zlib, and serialized with Python’s marshal module. To complicate analysis even further, these scripts often contain superfluous code blocks, including intentionally invalid operations like division by zero, which are designed to confuse or crash static analysis tools.
In addition to these technical methods, the malware includes sandbox evasion techniques. For example, execution may be delayed based on system uptime or only proceed if the malware determines that it is not running in a virtualized or debugged environment.
Defensive Recommendations
To defend against such threats, organizations should:
- Deploy EDR with In-Memory Detection: Solutions like Morphisec or CrowdStrike with memory inspection can catch PE hollowing and reflective DLL injection.
- Block LOLBins Execution: If not needed, block or restrict execution of certutil.exe, mshta.exe, and regsvr32.exe.
- DNS Sinkholing: Monitor and sinkhole DNS requests to newly registered domains, especially those without WHOIS history.
- Telegram Traffic Monitoring: Where feasible, inspect and block unauthorized Telegram bot communications.
- Security Awareness Training: Educate users on the risks of downloading executables from unknown or non-vetted platforms.
Conclusion
This campaign represents a broader trend in the cybercrime ecosystem. Malware-as-a-Service (MaaS) operators are taking advantage of popular trends, like AI content generation, to craft sophisticated lures. Moreover, the fake AI branding leverages social engineering in ways that are difficult to filter through technical controls alone.
The Noodlophile Stealer campaign is a stark reminder of how the convergence of hype (AI), trust manipulation (fake signatures), and technical sophistication (multi-stage loaders, memory injection) can form a potent malware delivery mechanism. For cybersecurity professionals, this underscores the importance of a layered defense strategy that includes not just tooling but also threat intelligence, user training, and network hygiene.
