On May 14, 2025, an alleged database containing 89 million Steam 2FA (two-factor authentication) codes surfaced online, prompting immediate attention. This incident, which has not been verified by official sources, marks a significant event in the realm of digital security.

The alleged leak claimed to include sensitive details such as Steam account names, email addresses, and 2FA codes. These codes, crucial for securing user accounts, were said to be part of a database advertised on a hacking forum for $5,000. The data reportedly contained historic SMS text messages with one-time passcodes, including recipient phone numbers, confirmation codes for account access, and metadata like timestamps and delivery statuses. If authentic, this information could expose users to phishing attacks and session hijacking, where hackers might intercept or replay 2FA codes to bypass login protections.

Following the emergence of these claims, Twilio, a communications platform reportedly involved, denied any breach. The company stated that it found no evidence of a breach on its systems, dismissing the notion that the data originated from their platforms. This denial is significant, as Twilio provides authentication services for many platforms, including Steam. The incident, if verified, could have far-reaching consequences, prompting a reevaluation of how cybersecurity measures are implemented.

As of now, Steam, operated by Valve Corporation, has not yet commented on the alleged breach. This lack of response left users uncertain about the safety of their accounts, amplifying concerns about personal information and account security. The incident highlights the broader challenge of maintaining user trust in an era where digital threats are increasingly sophisticated, especially as AI-driven public safety tools continue to evolve.

The ongoing focus is on verifying the leak’s authenticity and understanding its implications. This event serves as a stark reminder of the importance of robust cybersecurity in the age of AI, prompting a reevaluation of how these technologies are deployed. What are your thoughts on the alleged Steam 2FA code leak and Twilio’s denial—does it signal a broader issue with online security, or is it an isolated incident? Share your insights in the comments; we’re eager to hear your perspective on this developing story.

Cybercriminals are exploiting the popularity of AI technology by using fake AI video generation platforms to distribute a new malware called Noodlophile Stealer, according to a Morphisec report. Promoted through deceptive Facebook ads, these fraudulent sites trick users into downloading malicious software that steals sensitive data, such as browser credentials and cryptocurrency wallets. As AI tools gain mainstream traction, this emerging threat highlights the dark side of innovation, raising urgent concerns about online safety and the need for stronger cybersecurity measures.

The Noodlophile Stealer campaign operates with a sophisticated multi-stage attack. Morphisec’s analysis reveals that attackers lure users through Facebook groups with promises of instant AI-generated videos. Victims are prompted to upload images to the fake site, expecting a custom video in return. Instead, they download a malicious ZIP file disguised as a legitimate tool, often posing as a version of CapCut, a popular video editing software. Once executed, the file deploys Noodlophile Stealer, which harvests browser credentials, cryptocurrency wallets, and other sensitive data, and in some cases, installs the XWorm loader for remote access. This tactic echoes other AI-driven cyber threats, where malicious actors exploit trust in technology to target unsuspecting users.

Photo: Morphisec

The scale of the threat is alarming. Noodlophile Stealer, previously undocumented in public malware trackers, has been found to target a wide range of data, including cookies, passwords, and credit card information from browsers like Google Chrome, Microsoft Edge, and Mozilla Firefox. The use of Facebook ads amplifies the campaign’s reach, with social media platforms inadvertently serving as a distribution network for these fake tools. This mirrors broader trends in AI privacy debates, where the misuse of technology poses significant risks to user security.

The fake platforms often appear legitimate, complete with professional designs and cookie banners to build trust. However, their true intent becomes clear once the malicious payload is downloaded. Cybersecurity News reported that some sites, such as editproai[dot]pro, trick users into installing malware under the guise of an AI-based editing tool called “EditPro.” This deceptive strategy preys on the growing enthusiasm for AI content creation, a trend that has also fueled the development of AI communication tools aimed at enhancing user experiences. Unfortunately, it also creates opportunities for cybercriminals to exploit unsuspecting victims, particularly those unfamiliar with such risks.

Protecting against Noodlophile Stealer requires vigilance and robust cybersecurity measures. Experts recommend avoiding downloads from unverified sources, especially those promoted through social media ads, and using reputable antivirus software to detect and block malicious files. Morphisec advises investing in tools with dynamic detection and behavioral rules, such as Palo Alto Networks’ Cortex XDR, to combat evolving threats. However, the digital divide poses a challenge, as not all users have access to such tools or the knowledge to identify scams, a problem also seen in AI accessibility efforts. This underscores the need for broader education on digital safety, similar to initiatives in AI language tool discussions that aim to empower diverse users.

The rise of Noodlophile Stealer highlights the broader implications of AI’s rapid adoption. While AI offers transformative potential for content creation, it also provides cybercriminals with new avenues to exploit vulnerabilities. Social media platforms like Facebook must strengthen their ad vetting processes to prevent the spread of such campaigns, and users must remain cautious when engaging with unfamiliar AI tools. As AI continues to evolve, balancing innovation with security will be critical, much like how AI-driven public safety tools are working to protect communities while addressing ethical concerns. What do you think about the risks of fake AI platforms—how can users stay safe online? Share your thoughts in the comments—we’d love to hear your perspective on this growing threat.