Fake Google Gemini Installer Delivers Vidar Infostealer and Steals Browser Credentials
Summary
Darktrace says a customer downloaded a fake Gemini installer promoted via Google Colab and a secondary site. The Vidar stealer communicated with attacker infrastructure, and endpoint alerts indicated browser credential theft before Darktrace contained the device.
Key points
- In July 2026, a customer in EMEA ran a file named “Download_Google_Gemini_For_Windows.exe” from the Downloads folder.
- A Google Colab page prompted users to download an archive that led to a secondary site offering the fake installer; the exact download source was not confirmed.
- The archive reportedly instructed users to run the binary as administrator and add it to antivirus exceptions.
- Darktrace identified the executable as a newer Go-compiled Vidar variant that communicated with Telegram-based infrastructure.
- The executable contacted suspicious external infrastructure, including 91.98.98[.]86; endpoint alerts indicated browser credential and other sensitive-data theft.
- Darktrace blocked communication with suspicious infrastructure and quarantined the compromised device.
Article Details
- Victim Organization
- Not disclosed
- Incident Type
- Malware delivery and execution: a fake Google Gemini installer delivered the Vidar information stealer.
- Disclosure Date
- 2026-08-19
- Data Types Exposed
- Browser credentials
- Other sensitive data
- Operational Impact
- The affected endpoint was compromised and quarantined. Darktrace blocked communication with suspicious external infrastructure. The source reports activity consistent with theft of browser credentials and other sensitive data, but does not specify the amount of data taken.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dtm[.]kijangturbo88[.]top | Command-and-control endpoint associated with the activity. |
| DOMAIN | micronsoftwares[.]com | Secondary site posing as a Windows Software Hub and offering the fake Gemini installer for download. |
| IPV4 | 91[.]98[.]111[.]49 | Additional infrastructure associated with the activity, identified through SSL telemetry. |
| IPV4 | 91[.]98[.]98[.]86 | External destination contacted by the malicious executable and blocked during containment. |
| SHA256 | 1e13c2c9eac72daf63fd00a9946878949e159ae6ec51b54ec64f942d79d61913 | Hash of a malware sample associated with the fake Gemini installer. |
MITRE ATT&CK
T1036 · MasqueradingMasquerading as a legitimate Gemini installer.T1041 · Exfiltration Over C2 ChannelExfiltration over a command-and-control channel.T1071 · Application Layer ProtocolApplication-layer protocol used for command and control.T1204 · User ExecutionUser execution.T1204.002 · Malicious FileExecution of a malicious file.T1555 · Credentials from Password StoresCredential access from password stores.T1555.003 · Credentials from Web BrowsersCredential access from web browsers.
People
Malware
Vendors
Products
Google ColabDarktrace observed a customer download a fake Google Gemini installer hosted on Google Colab, resulting in the execution of the Vidar information stealer.Google GeminiDarktrace observed a customer download a fake Google Gemini installer hosted on Google Colab, resulting in the execution of the Vidar information stealer.Microsoft Defender for EndpointSubsequent alerts from the customer's Microsoft Defender for Endpoint integration later confirmed activity consistent with the theft of browser credentials and other sensitive data from the affected endpoint.