Noodlophile

Noodlophile is an information-stealing malware family first publicly reported in May 2025. It has been distributed through fake AI-themed tools promoted on Facebook and other social media, where victims were tricked into downloading malicious ZIP files. Early campaigns focused on stealing credentials and cryptocurrency wallet data, with exfiltration via Telegram bots. Later activity evolved to remote-work and recruitment-themed social engineering, using fake job postings, application forms, and skill assessment lures to target job seekers, students, and digital marketers. These newer campaigns delivered multi-stage stealers and Remote Access Trojans, including through DLL sideloading, and were linked in the provided reporting to the Vietnamese threat group UNC6229.

Recent Noodlophile variants were described as significantly evolving their anti-analysis and reverse-engineering resistance. Reported changes include padding files with millions of repetitions of a vulgar Vietnamese phrase directed at Morphisec to disrupt analysis pipelines, use of the djb2 hashing algorithm for dynamic API resolution, hardcoded signature validation to detect tampering, termination when modification or debugging is detected, RC4 encryption protecting a command file named "Chingchong.cmd," and XOR-encoded strings to evade simple string-based detections. Telegram remains central to the malware’s command-and-control and/or exfiltration workflow.

High-confidence capabilities directly mentioned in the content include theft of credentials and cryptocurrency wallets. The malware is also described broadly as an infostealer used in enterprise-targeting attacks and as part of multi-stage intrusion chains. The content additionally notes that researchers compared or grouped Noodlophile alongside other Vietnamese-attributed stealers such as PXA Stealer and NodeStealer, but only the UNC6229 linkage is explicitly stated for Noodlophile in the supplied material.