CTI · corroborated · 2026-08-21

Fake Google Gemini installer distributes Vidar stealer via Google Colab

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1204 User Execution Execution
• T1059 Command and Scripting Interpreter Execution
• T1503 Credentials from Web Browsers Credential Access
• T1041 Exfiltration Over C2 Channel Exfiltration

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Fake Google Gemini Installer Vidar Stealer Execution
id: b8d4f2e5-9c3a-4d7e-a6f1-2e8b5c9d3a7f
status: experimental
description: >
    Detects execution of the fake Google Gemini Windows installer used to
    distribute the Vidar information stealer (Darktrace, Aug 2026). The
    malicious executable Download_Google_Gemini_For_Windows.exe is hosted
    via Google Colab and harvests browser credentials on launch.
references:
    - https://cyberpress.org/hackers-use-fake-google-gemini-installer-to-deploy-vidar-stealer/
    - https://gbhackers.com/hackers-use-fake-google-gemini-installer-to-deploy-vidar-stealer/
author: Tia N. List
date: 2026/08/21
tags:
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection_filename:
        Image|endswith:
            - '\Download_Google_Gemini_For_Windows.exe'
    selection_colab:
        Image|contains: 'colab'
        Image|endswith: '.exe'
    condition: selection_filename or selection_colab
falsepositives:
    - None known; legitimate Google Gemini is a web service with no Windows installer
level: high

References

• https://cyberpress.org/hackers-use-fake-google-gemini-installer-to-deploy-vidar-stealer/
• https://gbhackers.com/hackers-use-fake-google-gemini-installer-to-deploy-vidar-stealer/