Noodlophile Stealer Expands Global Attacks Using Copyright Phishing and Telegram Evasion

For more than a year, a criminal operation has been systematically targeting companies across the United States, Europe, the Baltic region, and Asia-Pacific with a piece of malware called Noodlophile. The attackers have refined their approach considerably. Where they once relied on fake AI tools advertised on Facebook to lure victims, they now craft spear-phishing emails that impersonate copyright enforcement notices—complete with specific details about a company's Facebook pages and ownership structure, information they've gathered through reconnaissance.

The attack begins in an inbox. An employee receives what appears to be an urgent notice of copyright infringement, sent from a Gmail account to avoid raising suspicion. The message includes a link to Dropbox, where a compressed file or installer awaits. Once downloaded and executed, the payload triggers a chain of events designed to evade detection at every step. The installer uses a legitimate piece of software—Haihaisoft PDF Reader—to sideload a malicious library file. This technique, known as DLL sideloading, exploits the trust placed in legitimate applications to slip malicious code onto a system. Before the actual stealer launches, batch scripts run in the background to establish persistence, modifying the Windows Registry so the malware survives a reboot.

What distinguishes this campaign from earlier variants is the sophistication of its evasion infrastructure. Rather than connecting directly to a command-and-control server, the malware reaches out to Telegram group descriptions—a dead drop mechanism that resolves to the actual server hosting the stealer payload. This indirection makes the attack harder to detect and disrupt. The researchers tracking the campaign note that the attackers also employ obfuscated staging and in-memory execution, techniques that keep the malware off disk and therefore invisible to many security tools.

Noodlophile itself is a full-featured information stealer. It harvests data from web browsers and collects system information from infected machines. But the code tells a larger story. Embedded in the stealer are functions not yet activated—capabilities for taking screenshots, logging keystrokes, exfiltrating files, monitoring running processes, gathering network details, encrypting files, and extracting browser history. These dormant features suggest the developers are actively working to expand what the malware can do, transforming it from a focused browser-data harvester into a more versatile and dangerous tool.

The targeting pattern reveals the attackers' priorities. They focus heavily on enterprises with significant social media presence, particularly those active on Facebook. The reconnaissance-derived details in the phishing emails—specific page IDs, ownership information—suggest a deliberate effort to make each message feel legitimate and urgent. An employee who sees their company's actual Facebook page mentioned in a copyright notice is far more likely to click the link and download the file.

Security researchers first documented Noodlophile in May 2025, when the campaign was already underway. The copyright infringement angle is not entirely new; in November 2024, another group used similar lures to distribute a different stealer called Rhadamanthys. But Noodlophile's operators have taken the concept further, layering in technical sophistication that makes the malware harder to stop once it lands. The combination of targeted phishing, legitimate-software abuse, Telegram-based evasion, and an expanding feature set suggests a mature operation with resources and intent to keep evolving. As the developers continue adding capabilities, the threat will only grow more complex.