You're listening to the Cyberwire Network, powered by N2K.

Welcome to a very special Thanksgiving Angkor of Research Saturday.

This week, we explored the Nudlophile Steeler, a malware campaign disguised as AI video generation platforms.

Spread through viral social media campaigns,

it steals browser credentials, crypto wallets, and can deploy remote access trojans like Xworm,

all while posing as legitimate software. Michael Gorlick, CTO of Morphasek, explains how it works

and why it's so hard to detect. We hope you enjoy this encore

of Research Saturday. Thanks for listening and for those celebrating, have a safe and happy Thanksgiving.

From fishing to ransomware, cyber threats are constant, but with Nordlayer, your defense can be too.

Nordlayer brings together secure access and advanced threat protection in a single, seamless platform.

It helps your team spot suspicious activity before it becomes a problem by blocking malicious links and scanning

downloads in real time, preventing malware from reaching your network. It's quick to deploy,

easy to scale, and built on zero trust principles, so only the right people get access to the right

resources. Get 28% off on a yearly plan at Nordlayer.com slash Cyberwire Daily with code

cyberwire-28. That's Nordlayer.com slash Cyberwire daily code Cyberwire-28. That's valid through

December 10th, 2025. Hello, everyone and welcome to the CyberWires Research Saturday.

I'm Dave Bittner, and this is our weekly conversation with researchers and analysts

tracking down the threats and vulnerabilities, solving some of the hard problems and protecting ourselves in a rapidly evolving cyberspace.

Thanks for joining us.

So this is how we discovered, basically, the execution of the Infostil and the Noglisle was executing actually on one of our medium-sized customers.

And then we are starting to basically investigate a book back,

which actually discovered, brought to the discovery of a full chain of AI-firmary

...