Podcast Summary: CyberWire Daily – "A New Stealer Hiding Behind AI Hype" [Research Saturday]

Podcast Information:

• Title: CyberWire Daily
• Host/Author: N2K Networks
• Description: The daily cybersecurity news and analysis industry leaders depend on. Published each weekday, the program includes interviews with a wide spectrum of experts from industry, academia, and research organizations worldwide.
• Episode: A New Stealer Hiding Behind AI Hype [Research Saturday]
• Release Date: June 7, 2025

Introduction to Research Saturday

Timestamp: [01:31]

Dave Bittner, the host of CyberWire's Research Saturday, welcomes listeners to the weekly deep dive into the latest cybersecurity threats, vulnerabilities, and protective measures. This episode focuses on a newly discovered malware strain dubbed the "Noodle File Stealer," which is leveraging the burgeoning AI video generation trend as a vector for its distribution.

Discovery and Initial Findings

Timestamp: [01:56]

Michael Gorlick, Chief Technology Officer at Morphisec, introduces the primary subject of discussion—the Noodle File Stealer. He explains how the team initially identified the malware during an investigation involving one of their medium-sized clients. This led to uncovering a comprehensive chain of compromised AI frameworks, highlighting a sophisticated attack methodology.

Understanding Noodle File Stealer

Timestamp: [02:24]

Michael elaborates on the characteristics and functionalities of the Noodle File Stealer, describing it as a highly advanced threat that employs uncommon delivery techniques:

"The delivery technique is quite advanced and relatively rare, in which it was delivered through Python in memory with base 85 encoding, which is kind of very different from base 64." ([02:51])

Key Functions:

• Browser Hijacking: Targets and compromises browser histories and settings.
• Credential Theft: Intercepts wallet credentials and other sensitive information.
• Minimal Footprint: Designed to evade detection by maintaining a low profile on infected endpoints.

Infiltration Methods and Social Engineering Tactics

Timestamp: [03:40]

Michael delves into how the malware infiltrates systems, emphasizing the sophisticated social engineering strategies employed:

"They distribute the malware via fake AI video generation platforms, presenting malicious actors as legitimate services." ([06:42])

Delivery Process:

1. Archive Downloads: Victims are tricked into downloading archives disguised as innocuous documents or invoices from fraudulent AI platforms.
2. Obfuscated Content: The archives contain altered file headers to bypass standard security scanners.
3. Execution of Payload: Upon extraction and execution, the malware activates, employing dual encoding (Base64 and Base85) to decrypt and launch the malicious code.

Michael explains the complexity of this method:

"It's quite an advanced archive with executables that are blown up to proportions of 150, 160, 170 megabytes with many advanced techniques." ([03:47])

Technical Analysis of the Malware

Timestamp: [16:58]

Michael provides an in-depth technical breakdown of the Noodle File Stealer:

"They use a combination of base 64 and base 85, which is quite rare. We saw those techniques in some GitHubs correlated to Korean attacks." ([16:58])

Technical Highlights:

• Dual Encoding: Utilizes both Base64 and Base85 encoding to obscure the Python code, making detection harder.
• Concurrent Malware Delivery: Often delivered alongside other malware, such as the X Worm, enhancing persistence and functionality.
• Stealth Features: Incorporates native executables and network code that complicate detection by traditional security measures.

Challenges in Detection and Mitigation

Timestamp: [14:28]

The conversation shifts to the difficulties faced by security professionals in identifying and mitigating threats like the Noodle File Stealer:

"The archive makes it quite challenging to detect by existing controls. You need more sophisticated controls and places like ours." ([14:39])

Challenges:

• Hidden Malicious Content: Malicious executables are embedded within archives that appear legitimate, evading perimeter defenses.
• Advanced Delivery Techniques: Use of in-memory execution and obfuscated payloads bypass standard scanning mechanisms.
• Resource Intensive Solutions: Effective detection requires more advanced security controls, such as application hardening and strict execution policies.

Recommendations:

• Avoid Downloading Archives: Users should refrain from downloading archives from untrusted AI platforms.
• Implement Advanced Security Measures: Organizations should adopt application controls and other hardening techniques to prevent unauthorized executable execution.
• Monitor Outbound Communications: Vigilant monitoring can help identify unusual outbound traffic indicative of malware activity.

Implications and Future Outlook

Timestamp: [19:22]

In concluding remarks, Michael shares his perspective on the broader implications of these findings:

"This reminds me of the 2016 exploit kit times... It will take a year or two until security controls adapt to this new delivery risk." ([19:22])

Key Points:

• Evolving Threat Landscape: The integration of AI hype in malware distribution signifies a new phase of cyber threats that exploit current technological trends.
• Urgent Need for Adaptation: Security measures must evolve rapidly to keep pace with innovative attack vectors.
• User Vigilance: Emphasizes the importance of cautious behavior online, especially when interacting with AI-driven platforms and downloading content.

Concluding Thoughts

Timestamp: [19:22]

Mike emphasizes the constant cat-and-mouse game between cybersecurity professionals and malicious actors:

"Hackers are innovate at a crazy pace, and with AI, they innovate even faster. We'll always have sophisticated malware." ([19:22])

Takeaways:

• Stay Informed: Continuous education on emerging threats is vital for both individuals and organizations.
• Proactive Defense: Implementing proactive and layered security strategies can mitigate the risks posed by sophisticated malware.
• Collaborative Efforts: Sharing insights and research within the cybersecurity community enhances collective defense mechanisms against evolving threats.

Key Quotes with Timestamps

• Michael Gorlick on Delivery Techniques:

  "This delivery technique is quite advanced and relatively rare, in which it was delivered through Python in memory with base 85 encoding, which is kind of very different from base 64." ([02:51])

• On Detection Challenges:

  "The archive makes it quite challenging to detect by existing controls. You need more sophisticated controls and places like ours." ([14:39])

• Michael on Future Security Needs:

  "This reminds me of the 2016 exploit kit times... It will take a year or two until security controls adapt to this new delivery risk." ([19:22])

Conclusion

This episode of CyberWire Daily's Research Saturday provides a comprehensive analysis of the newly identified Noodle File Stealer malware. By exploiting the popularity of AI video generation platforms, the malware employs sophisticated delivery and obfuscation techniques to infiltrate targeted systems. The discussion underscores the necessity for advanced security measures and heightened user awareness to combat such evolving cyber threats. As AI technologies continue to advance, so too do the strategies of malicious actors, making continuous vigilance and adaptation paramount in the field of cybersecurity.