Fake Gemini installer delivers Vidar infostealer via Google Colab lure
Attackers used a fake Google Gemini installer hosted on Google Colab to deliver a Go-compiled Vidar infostealer that stole browser credentials from an EMEA company.
Darktrace investigated an EMEA company infection where the top search result for a Gemini-related filename pointed to a Google Colab page that redirected to a fake 'Windows Software Hub' hosting a malicious executable. The ZIP contained a README instructing victims to run the file as administrator and add it to antivirus exceptions, delivering a newer Go-compiled Vidar variant that used dtm[.]kijangturbo88[.]top over Telegram-based infrastructure. The malware stole browser credentials and other sensitive data; Darktrace's Autonomous Response blocked the C2 and quarantined the device.