Cybercriminals Unleash Noodlophile Malware via Fake AI Tools on Facebook

Cybercriminals Unleash Noodlophile Malware via Fake AI Tools on Facebook

At a glance

• Malware campaign: Criminals are promoting fake AI tools on Facebook to spread the Noodlophile infostealer.
• Who is targeted: People looking for AI video and image tools, including content creators and small businesses.
• Who found it: Researchers at Morphisec reported the campaign in May 2025.
• Defenses: Be suspicious of AI tools promoted in social media groups and never run downloaded “videos” that are really programs.
• The trend: Social media is a growing channel for malware delivery.

How the fake AI tools lure victims

Criminals are spreading the Noodlophile malware through fake AI tools promoted on Facebook. They exploit interest in AI by advertising websites that claim to turn photos into AI-generated videos, impersonating tools such as Luma Dream Machine and CapCut. The lures appear in Facebook groups, some with tens of thousands of views.

Researchers at Morphisec found that the scheme works because the sites look polished and legitimate. Users upload an image or video, then download a “processed” result: a ZIP file named VideoDreamAI.zip containing an executable disguised as a video, such as “Video Dream MachineAI.mp4.exe”.

What Noodlophile steals

Noodlophile is an infostealer. Running the fake video file starts a chain of loaders that ends with the stealer installed on the victim’s machine. It takes saved browser passwords, cookies, session tokens and cryptocurrency wallet data, then sends them to the attackers through a Telegram bot.

Some variants also install XWorm, a remote access trojan that gives attackers deeper control of the infected computer. Morphisec traced the malware to a seller advertising it on cybercrime forums as malware-as-a-service.

Why Facebook works for attackers

Facebook’s huge user base lets criminals reach many people cheaply. Group posts and ads can spread a lure far beyond its first audience.

Using Facebook to spread malware is not new. Fake AI tools are the newer twist, combining the hype around AI with Facebook’s reach.

How to avoid infection

Defense is simple. Use AI tools only from their official sites or app stores. Look at file extensions before opening anything: a “video” that ends in .exe is a program. Keep systems patched and run security software that flags infostealers.

Companies should block unapproved software downloads, train staff to spot these lures and watch for unusual logins after an employee reports a suspicious download.

Part of a larger pattern

The campaign fits a broader trend of criminals using social media to deliver malware. Attackers follow public interest closely, and AI tools are what people want right now.

Security researchers expect AI-themed lures to keep growing as more people try new tools. Expect more.

If you downloaded one of these tools

Anyone who downloaded a “video” from one of these sites should assume their browser passwords and sessions are stolen.

Scan the machine with up-to-date security software or reinstall it, then change passwords from a clean device and log out all active sessions. Move any cryptocurrency to a new wallet. Turn on multi-factor authentication everywhere it is offered.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.