Fake Gemini installer delivers Vidar infostealer via Google Colab lure
Attackers used a fake Google Gemini installer hosted on Google Colab to deliver a Go-compiled Vidar infostealer that stole browser credentials from an EMEA company.
Darktrace investigated an EMEA company infection where the top search result for a Gemini-related filename pointed to a Google Colab page that redirected to a fake 'Windows Software Hub' hosting a malicious executable. The ZIP contained a README instructing victims to run the file as administrator and add it to antivirus exceptions, delivering a newer Go-compiled Vidar variant that used dtm[.]kijangturbo88[.]top over Telegram-based infrastructure. The malware stole browser credentials and other sensitive data; Darktrace's Autonomous Response blocked the C2 and quarantined the device.
- Lure abused Google Colab hosting to make the fake Gemini download look legitimate
- Vidar variant used Telegram-based C2 at dtm[.]kijangturbo88[.]top
- README instructed admin execution and adding the binary to antivirus exception lists
- Autonomous response blocked malicious infrastructure and quarantined the infected host
- ATT&CK
- T1189 Drive-by CompromiseT1204.002 Malicious FileT1562.001 Impair Defenses: Disable or Modify ToolsT1555.003 Credentials from Web BrowsersT1071.001 Web Protocols
- Vendors
- Products
- Google GeminiGoogle Colab
- Malware
- Vidar
- Organizations
- Darktrace
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dtm.kijangturbo88.top | that communicated with Telegram-based infrastructure, using dtm[.]kijangturbo88[.]top as its command-and-control endpoint. “While the malware |
From the original article
2 min read at helpnetsecurity.com
A malicious executable masquerading as a Google Gemini installer was used to deliver the Vidar infostealer on a company network in the EMEA region, according to Darktrace researchers who investigated the incident.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.