Infostealer Targets Users via Fake AI Video Sites

Hackers are targeting users into downloading infostealers by tricking them into clicking on links that claim to produce artificial intelligence-generated videos.

See Also: 2025 AI Adoption & Risk Report

The campaign uses bogus generation platforms to distribute the Noodlophile stealer, previously undocumented malware that siphons browser credentials, session cookies, cryptocurrency wallets and sensitive documents, found researchers from Morphisec

The campaign’s exploitation of AI as a social engineering lure makes it unique, researchers said. “Unlike older malware campaigns disguised as pirated software or game cheats, this operation targets a newer, more trusting audience: creators and small businesses exploring AI for productivity,” they said.

The attackers build websites with names such as “Dream Machine” and “Video Dream AI,” promoting them on high-visibility Facebook groups, some exceeding 60,000 views. The visitors are prompted to upload images or videos ostensibly for AI-powered transformation. Instead of returning the promised media file, the sites supply a ZIP archive containing a misleadingly named executable, dubbed Video Dream MachineAI.mp4.exe and a hidden folder of support components.

Morphisec said that the executable is signed with a Winauth-generated certificate. “Despite its misleading name [suggesting an .mp4 video], this binary is actually a repurposed version of CapCut, a legitimate video editing tool. This deceptive naming and certificate help it evade user suspicion and some security solutions,” the researchers said.

The binary on execution launches an embedded .NET loader within CapCut.exe, which renames and runs a disguised batch script originally labeled Document.docx. That script uses the legitimate Windows utility certutil.exe to decode a Base64-encoded, password-protected RAR archive masquerading as Document.pdf, extracts its contents via a bundled RAR tool and establishes persistence through a Registry Run key. A Python-based payload named srchost.exe is then executed.

The final stage fetches a remote script, randomuser2025.txt, that deploys Noodlophile Stealer entirely in memory. If the antivirus product Avast is detected, the stealer uses PE hollowing to inject into regAsm.exe. Otherwise, it resorts to shellcode injection. Stolen data is exfiltrated through a Telegram bot, granting attackers real-time access to harvested credentials, cookies, tokens and wallet files.

Open-source investigations link Noodlophile to Vietnamese-language darknet forums, where it is offered as part of a malware-as-a-service package, often bundled with “Get Cookie + Pass” offerings for account takeover. Operators promote and support these fake AI platforms through social media profiles tied to the same handles.