Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes. A fake AI video generator can deliver malware. In a campaign documented by Morphisec on May 8, 2025, criminals promoted imitation generative-AI websites through social media, asked visitors to upload images or video, and then presented a malicious download as the finished result. The reporting describes a criminal lure built around interest in generative AI—not a breach of the legitimate AI services being impersonated.
What happened in the fake AI-video campaign
Morphisec reported that attackers advertised fraudulent content-generation sites in social-media channels, including Facebook groups. Some pages impersonated services such as Luma AI Dream Machine. The sites were designed to look like a normal AI workflow: upload media, wait through a simulated processing sequence, and download the generated video.
In the analyzed chain, the promised output was not a video. The visitor received a malicious archive containing a deceptive executable. Morphisec’s technical report identified a ZIP file named VideoDreamAI.zip with an executable whose name was intended to resemble an MP4 file. The important warning is behavioral: an unexpected executable was delivered where a media file was expected.
One social-media post cited by Morphisec exceeded 62,000 views. That number describes views of one post; it is not a count of infections, victims, or successful downloads.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What the malware could steal
Morphisec attributed the main information-stealing capability to Noodlophile Stealer. According to its May 2025 analysis, the malware could target:
- Browser-stored credentials
- Cookies and session data
- Authentication tokens
- Cryptocurrency-wallet information
Morphisec said stolen information was sent through a Telegram bot. It also reported cases in which an infection included XWorm, a remote-access trojan and loader with additional propagation capabilities. Those findings do not mean every infection had exactly the same components.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
“Noodlophile Stealer represents a new addition to the malware ecosystem,” Morphisec researcher Shmuel Uzan wrote in the May 8, 2025 threat analysis.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
What this incident does—and does not—show
| Established by the reporting | Not established by the reporting |
|---|---|
| Criminals used fake AI-media sites and social posts as the lure. | That the legitimate AI service being impersonated was breached. |
| Users were asked to upload media and then shown a malicious download as the result. | That every AI download or AI website is dangerous. |
| Morphisec linked Noodlophile to theft of browser data, tokens and wallet information, and reported XWorm in some cases. | A reliable total number of victims or infections. |
| The primary campaign account was published May 8, 2025; Dark Reading covered it May 12, 2025. | That the original domains or infrastructure are still active in September 2026. |
Morphisec published additional context in February 2026, but that follow-up does not establish that the specific 2025 domains remain online or malicious today.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to tell whether an AI tool download is safe
Start from the vendor’s real channel
Reach an AI service through the vendor’s verified official website or official app listing. Do not treat a social-media advertisement, group post or shortened link as proof that the destination is genuine. If a post claims to represent a known service, open a new browser tab and navigate to that service independently.
Match the file to the promised output
A video-generation service should normally return a media file or provide the result inside its authenticated web interface. Be suspicious when the site unexpectedly supplies a ZIP archive, installer or executable. A filename that uses a media-looking name or extension is not a safety guarantee; inspect the actual file type and do not run it merely because it appears to be an MP4.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Stop at unusual download requirements
Uploading an image or video does not justify installing an unrelated program, disabling security controls or opening an executable sent as a “codec,” “player” or generated result. An unexpected archive after a simulated processing screen is a strong reason to stop and close the page.
What to do if you downloaded the fake result
- Do not open or run the file. Keep the archive or executable closed and do not bypass warnings from the operating system or browser.
- Disconnect the affected device from networks if you opened the file or observed suspicious behavior. This can limit additional communication while the device is assessed.
- Use your organization’s incident process if the device belongs to an employer, school or client. Tell the security or IT team what you downloaded, when you downloaded it and whether you executed it.
- From a known-clean device, change exposed passwords and revoke active sessions for accounts used in the browser. Prioritize email, financial services, cryptocurrency wallets and administrator accounts.
- Have the device examined and scanned with the security tools maintained by your organization or a qualified incident-response provider. Do not assume that deleting the visible ZIP file proves the system is clean.
The cited campaign reports describe the malware chain but do not provide a campaign-specific recovery checklist. The steps above are general precautions for a potentially malicious download, not a claim that every visitor to one of the reported sites was infected.
What businesses should change
Dark Reading’s coverage highlighted user education and separating business activity from personal browsing as risk-reduction measures. Training should show employees why a social post, a familiar logo and a convincing “AI processing” animation are not authenticity checks. Organizations can also apply their normal endpoint, browser, identity and network controls and maintain a clear reporting path for suspicious downloads. These measures reduce risk; they do not guarantee prevention.
Bottom line
The May 2025 Morphisec investigation documented a specific social-engineering pattern: fake AI video sites collected an upload, simulated generation and delivered malware disguised as the result. Noodlophile Stealer was associated with theft of browser credentials, cookies, tokens and cryptocurrency-wallet data, while XWorm appeared in some reported infections. Use verified vendor channels, reject unexpected executables and treat the original campaign as a historical report unless current evidence shows otherwise.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
