Threat actors are leveraging the growing public interest in AI technologies by deploying a sophisticated campaign that distributes a new information-stealing malware called Noodlophile, disguised as AI-powered content creation tools. Promoted via deceptive social media posts and Facebook groups advertising platforms like “Dream Machine” or fake versions of CapCut AI, these campaigns lure users with promises of AI-generated video and image editing. When users interact with the sites, they are prompted to upload content and subsequently download a ZIP archive supposedly containing the generated media. Instead, the archive holds a malicious executable disguised as a video file (“Video Dream MachineAI.mp4.exe”) that initiates a multi-stage infection chain. This process includes the use of a repurposed CapCut binary, batch scripts, and legitimate Windows utilities like “certutil.exe” to decode and deploy the final payload. The malware, loaded in memory via obfuscated Python code, is capable of harvesting browser credentials, cookies, session tokens, and cryptocurrency wallet data, with stolen information exfiltrated via a Telegram bot. In some instances, Noodlophile is also bundled with the XWorm remote access trojan (RAT) for persistent access. The malware has been linked to Vietnamese-speaking actors and is being offered as part of a malware-as-a-service (MaaS) operation on dark web forums, sometimes bundled with “Get Cookie + Pass” services. Noodlophile’s stealthy execution, lack of prior documentation, and use of real-time command-and-control (C2) channels like Telegram mark it as a significant new entrant in the infostealer landscape, while a parallel emergence of simpler threats like PupkinStealer highlights the broader trend of increasingly accessible cybercrime toolkits. CTIX analysts will continue to report on the latest malware strains and attack methodologies.