Reported by 2 outlets
Fake Google Gemini installer distributes Vidar stealer via Google Colab
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
update from gbhackers.com
Hackers Use Fake Google Gemini Installer to Deploy Vidar Stealer and Steal Browser Credentials
gbhackers.com · 53d ago · August 21st, 2026
Threat actors are exploiting interest in generative AI software to distribute the Vidar information stealer through a fake Google Gemini installer hosted via Google Colab. Darktrace investigated the July 2026 intrusion in an EMEA customer environment, where a user downloaded and executed a malicious file named Download_Google_Gemini_For_Windows.exe The campaign did not rely on a conventional […] The post Hackers Use Fake Google Gemini Installer to Deploy Vidar Stealer and Steal Browser Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Hackers Use Fake Google Gemini App to Steal Windows Users’ Browser Credentials
cyberpress.org · 53d ago · August 21st, 2026
Threat actors are increasingly abusing the growing popularity of generative AI tools to spread malware. In a recent incident observed by Darktrace, attackers used a fake Google Gemini installer to infect a Windows device with the Vidar information stealer. The campaign targeted users actively looking for AI software rather than relying on traditional phishing emails. Darktrace detected suspicious activity after the executable launched from a user’s Downloads folder in an organization in the Europe, Middle East and Africa region in July 2026. Fake Gemini Steals Credentials Investigators found that searches for the suspicious filename led to a Google Colab page. Google Colab is a legitimate cloud-based platform used to run Jupyter notebooks and machine-learning workloads. The page displayed a download prompt that redirected victims to micronsoftwares[.]com , a site posing as a “Windows Software Hub.” The secondary site offered a ZIP archive containing the fake Gemini installer. The archive also included a README file that told users to run the executable with administrator privileges and add it to antivirus exclusion lists. The secondary website posing as a “Windows Software Hub” download page, which likely hosted the fake Gemini installer (Source: darktrace) These instructions are a major warning sign. Legitimate software installers should not require u