Noodlophile Stealer Advances with Obfuscation, Social Media Deception

Noodlophile Stealer Advances with Obfuscation and Social Media Deception

Global Cybersecurity Threat Advisory – August 2025

The Noodlophile Stealer malware campaign has evolved into a sophisticated global cyber threat, leveraging social engineering, obfuscation techniques, and Telegram-based command-and-control (C2). Initially limited in scope, it now aggressively targets enterprises across the United States, Europe, the Baltics, and Asia-Pacific (APAC). By posing as fake copyright infringement notices, attackers manipulate victims into clicking malicious Dropbox links or opening disguised files.

Attack Regions Targeted

Widespread Global Focus Across US, Europe, Baltics, and APAC

This malware campaign uses AI-powered localization and multilingual spear-phishing lures to scale its attacks. Industries and enterprises with visible social media footprints are at highest risk, particularly those managing Facebook Pages and other online assets.

Attack Vector and Delivery Tactics

Phishing, Fake Copyright Notices, and Dropbox Delivery

Attackers distribute phishing emails impersonating Facebook copyright violation warnings. Victims are tricked into opening malicious attachments or Dropbox-hosted payloads, disguised as .docx or .png files. By exploiting DLL side-loading vulnerabilities in legitimate applications like Haihaisoft PDF Reader and Excel converters, attackers stealthily inject malware into systems.

Malware Execution and Persistence

DLL Side-Loading, Python Interpreters, and Registry Manipulation

The execution phase relies on recursive stub loading and BAT/Python scripts for persistence. Registry modifications ensure the malware survives reboots, while obfuscated scripts escalate evasion. Hosting payloads on free file-sharing platforms adds resilience against takedowns.

Data Harvesting Capabilities

Credential Theft, Browser Data, and Financial Information

At its core, the Noodlophile Stealer aggressively harvests:

• Credentials and passwords from web browsers

• Cookies and credit card data

• System metadata and security configurations

• Stored authentication tokens

To evade detection, it sometimes deploys .NET executables to disable monitoring, uses self-deletion routines, and hides forensic traces.

Command and Control (C2) Infrastructure

Telegram-Based Evasion and Obfuscation

The malware leverages Telegram-based C2 channels for encrypted communications, making detection harder. This infrastructure strengthens its resilience, stealth, and adaptability.

Recommendations for Defense

Proactive Cybersecurity Measures Against Noodlophile Stealer

• Be wary of copyright claim emails – Verify through official channels, not Gmail accounts.

• Scan all shared attachments and Dropbox links before opening.

• Harden browser defenses – Encourage password managers and enforce MFA.

• Deploy advanced EDR/NGAV solutions with behavioral and machine-learning detection.

MITRE ATT&CK Mapping

Techniques Leveraged by Noodlophile Stealer

The campaign maps to multiple MITRE ATT&CK TTPs, including:

• Phishing & Spearphishing (T1566, T1566.001, T1566.002)

• User Execution of Malicious Files (T1204, T1204.002)

• DLL Hijacking & Execution Flow Hijacking (T1574, T1574.001)

• Credential Access (T1555, T1555.003)

• Data Exfiltration via Web Services (T1567)

• Command and Scripting Interpreter (T1059, T1059.006)

• Obfuscation and Defense Evasion (T1027, T1070)

Full list of mapped TTPs is available in the report.

Indicators of Compromise (IOCs)

Malicious URLs, SHA256 Hashes, and Telegram Channels

The campaign uses Dropbox links, TinyURL, T2M shorteners, Pastebin references, and Telegram channels to deliver malware and exfiltrate data. Multiple SHA256 hashes of payloads have been tracked, enabling defenders to strengthen detection rules.

References

1. Morphisec – Noodlophile Stealer Evolves with Targeted Copyright Phishing
   (Note: The PDF contained multiple duplicate references to the same source – included here once for clarity.)