Ankura CTIX FLASH Update - May 13, 2025

Malware Activity

Fake AI Video Generator Used to Download Infostealer Malware Noodlophile

Threat actors are leveraging the growing public interest in AI technologies by deploying a sophisticated campaign that distributes a new information-stealing malware called Noodlophile, disguised as AI-powered content creation tools. Promoted via deceptive social media posts and Facebook groups advertising platforms like "Dream Machine" or fake versions of CapCut AI, these campaigns lure users with promises of AI-generated video and image editing. When users interact with the sites, they are prompted to upload content and subsequently download a ZIP archive supposedly containing the generated media. Instead, the archive holds a malicious executable disguised as a video file ("Video Dream MachineAI.mp4.exe") that initiates a multi-stage infection chain. This process includes the use of a repurposed CapCut binary, batch scripts, and legitimate Windows utilities