Fake AI Tools Push New Noodlophile Stealer Through Facebook Ads

Morphisec disclosed a multi-stage campaign that lures victims with fake AI video/image generation sites (promoted via Facebook) to download a ZIP containing a malicious CapCut-branded executable that unpacks and installs the Noodlophile stealer and an XWorm loader. The report details infection TTPs (signed repurposed executable, password-protected archives, Python payloads, in-memory execution, shellcode injection/PE hollowing), exfiltration via Telegram, and attribution leads to an individual likely promoting the malware on social platforms and marketplaces.