gcdRadar
closedclosed 22 May 2025Breaches & attacks3 Confirmed exploitationAI

Noodlophile Stealer Distributed via Fake AI Video Platforms

Noodlophile Stealer, XWorm

Threat actors deployed fake AI video generation sites to trick users into downloading information-stealing malware. The malicious campaign harvested credentials and enabled remote access.

first report
8 May 2025
last update
8 May 2025

Timeline · 1

  1. 8 May 2025Noodlophile Stealer Reportedly Distributed Through Allegedly Fraudulent AI Content Platforms

Sources · 1

Research and catalogues

  1. 2025-05-08

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

AI role
AI-enabled attack
categories
AI phishing / social engineering
severity
3 · Confirmed exploitation
targets
Individuals
owasp llm top 10
no entry for these categories
dates
happened 8 May 2025 · first reported 8 May 2025
origin
AI Incident Database
Derived from the AI Incident Database (CC BY-SA 4.0).
record
confidence 0.90 · created 2026-10-18 06:33Z · updated 2026-10-18 06:59Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# Noodlophile Stealer Distributed via Fake AI Video Platforms

https://gcdradar.vercel.app/incidents/noodlophile-stealer-distributed-via-fake-ai-video-platforms · AIR-2025-0102 · closed 2025-05-22

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation)
- Fix status: No fix needed
- First reported: 2025-05-08
- AI role: AI-enabled attack
- Products: Noodlophile Stealer, XWorm

## Summary

Threat actors deployed fake AI video generation sites to trick users into downloading information-stealing malware. The malicious campaign harvested credentials and enabled remote access.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-05-08: Noodlophile Stealer Reportedly Distributed Through Allegedly Fraudulent AI Content Platforms (https://incidentdatabase.ai/cite/1080)

## Sources

- 2025-05-08 AI Incident Database: Noodlophile Stealer Reportedly Distributed Through Allegedly Fraudulent AI Content Platforms https://incidentdatabase.ai/cite/1080

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. closed
    AI
  2. closed
    AI-Enabled Clickbait Campaign Targets Adolescents with Malware

    Breaches & attacks · Exploited · since 30 May 2025

    AI
  3. closed
    FBI Warns of AI Voice Cloning Campaign Targeting Officials

    Breaches & attacks · Exploited · since 15 May 2025

    AI
  4. closed
    Australian Analyst Targeted by Scam Using AI-Generated Websites

    Breaches & attacks · Exploited · since 27 Apr 2025

    AI
  5. closed
    AI
  6. closed
    Facebook Deepfake Investment Scam Impersonates Economist David Rosenberg

    Breaches & attacks · Real loss · since 15 Apr 2025

    AI