Cybercriminals Exploit AI Hype to Distribute Vidar Stealer via Fake Google Gemini Installer In July 2026, threat actors leveraged the growing interest in generative AI to distribute the Vidar information stealer through a fake Google Gemini installer hosted on Google Colab. Darktrace uncovered the campaign after investigating a compromise in an EMEA-based customer environment, where a user downloaded and executed a malicious file named Download_Google_Gemini_For_Windows.exe. Unlike traditional phishing attacks, this campaign exploited trust in Google’s branding and cloud services. Victims searching for AI tools were directed to a Google Colab page a legitimate Jupyter notebook service displaying a download prompt. The page redirected users to micronsoftwares[.]com, a spoofed "Windows Software Hub" offering the fake installer. While the full download chain couldn’t be reconstructed, SSL sessions to Google Colab preceded the execution of the malicious binary, strongly suggesting the Colab page as the initial infection vector. The downloaded ZIP archive contained the executable and a README file instructing users to run the binary with administrator privileges and disable antivirus exclusions classic social engineering tactics to bypass security controls. Darktrace identified the payload as a Go-compiled Vidar variant, communicating with Telegram-based command-and-control (C2) infrastructure via dtm[.]kijangturbo88[.]top. Post-execution, the malware connected to 91.98.98[.]86 and 91.98.111[.]49 over TCP/443, exfiltrating browser credentials, session cookies, autofill data, and cryptocurrency wallet artifacts. Darktrace detected the compromise through behavioral analytics, identifying suspicious process execution from the Downloads folder, anomalous encrypted outbound traffic, and credential-harvesting indicators. Its Autonomous Response capability blocked C2 communications and quarantined the infected endpoint. The incident highlights a shift in malware distribution tactics, where attackers abuse trusted cloud platforms and AI branding to reduce victim suspicion. By repackaging commodity malware as a legitimate AI tool, threat actors exploit enterprise adoption trends, making detection harder. Organizations are advised to restrict software installations to approved sources, monitor execution from Downloads/temporary directories, and hunt for Gemini-themed installers from unofficial channels. Indicators of Compromise (IoCs): - Files: Download_Google_Gemini_For_Windows.exe, GoogleAppInstaller.exe - IPs: 91.98.98[.]86, 91.98.111[.]49