Noodlophile Stealer Hides Behind Bogus Copyright Complaints

Morphisec research, summarized by Dark Reading, describes the Noodlophile campaign that targets enterprises with highly tailored spear-phishing emails posing as copyright complaints tied to corporate Facebook pages. Attackers use malicious links (often via TinyURL/Dropbox), disguised archives and DLL sideloading of legitimate signed applications, plus Telegram-based staging and in-memory execution to deploy an infostealer that harvests credentials, web and system data, and payment information while employing self-deletion and evasion techniques; the report includes IOCs and defensive recommendations such as user training and phishing-resistant MFA.