Show Notes
Please enjoy this encore of Research Saturday.
This week, we are joined by Michael Gorelik, Chief Technology Officer from Morphisec, discussing their work on "New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms." A new threat dubbed Noodlophile Stealer is exploiting the popularity of AI-powered content tools by posing as fake AI video generation platforms, luring users into uploading media in exchange for malware-laced downloads.
Distributed through convincing Facebook groups and viral campaigns, the malware steals browser credentials, cryptocurrency wallets, and can deploy a remote access trojan like XWorm. The campaign uses a layered, obfuscated delivery chain disguised as legitimate video editing software, making it both deceptive and difficult to detect.
The research can be found here:
New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms
Learn more about your ad choices. Visit megaphone.fm/adchoices
More from Research Saturday
Today we have Damon Rouse, Threat Intelligence from Lumen's Black Lotus Labs, discussing their work on "The infrastructure quartermaster: inside a China-nexus state enablement model." Black Lotus Labs identified a China-nexus cyber infrastructure provider, dubbed a “quartermaster,” that supplies reconnaissance, proxy routing, and obfuscation services to Chinese cyber espionage actors.
Dan Lisichkin, AI Security Researcher from Pillar Security, discussing their work on "A WIF Of Fresh Access, How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise." Researchers at Pillar Security uncovered a vulnerability in Google’s Gemini CLI workflows that could allow an attacker to turn a malicious GitHub issue into remote code execution and gain elevated access to a Google Cloud Platform (GCP) project.
Adam Meyers, Head of Counter Adversary Operations at CrowdStrike, is discussing their work on "PhantomRaven, An LLM-Generated Information Stealer Developed for Bug Bounty Hunting." PhantomRaven, a JavaScript-based information stealer distributed through malicious npm packages by a financially motivated threat actor posing as a bug bounty hunter.
Today we are joined by Jean-Pierre Mouton, Senior Threat Intelligence Consultant at GuidePoint Security, discussing their work on "How Play Achieves Encryption." Play ransomware, also known as PlayCrypt, continues to target organizations across multiple sectors using a consistent double-extortion playbook that combines data theft with widespread encryption. A recent investigation details how the group gained access through a SonicWall VPN, moved laterally using tools such as Mimikatz and PsExec, exfiltrated sensitive data, and used the victim’s own SentinelOne uninstallation utility to disable endpoint protection. The findings highlight several behavioral indicators defenders can monitor, including tool staging through SYSVOL and SystemBC for command and control, event log clearing, and suspicious WinSCP activity.
Today we are joined by Ensar Seker, VP of Research and CISO at SOCRadar, discussing their work on "Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain." An investigation into AnonyMousKIT reveals an AI-powered Phishing-as-a-Service platform designed to steal Apple credentials and disable Activation Lock on stolen devices.