Hackers Use Fake Google Gemini Installer to Deploy Vidar Stealer and Steal Browser Credentials

Gbhackers •Mayura Kathir • August 21, 2026

Threat actors are exploiting interest in generative AI software to distribute the Vidar information stealer through a fake Google Gemini installer hosted via Google Colab. Darktrace investigated the July 2026 intrusion in an EMEA customer environment, where a user downloaded and executed a malicious file named Download_Google_Gemini_For_Windows.exe The campaign did not rely on a conventional […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fake Google Gemini Installer Distributes Vidar Infostealer via Google Colab A malicious executable disguised as a Google Gemini installer was used to deploy the Vidar infostealer on a company network in the EMEA region. Darktrace researchers reported that a user downloaded and executed a file named Download_Google_Gemini_For_Windows.exe, which was hosted on Google Colab. This incident, which occurred in July 2026, highlights the exploitation of interest in generative AI software by threat actors. The attack method involved social engineering to lure users into executing the malicious file. The scope of the impact remains unclear, but it specifically targeted a customer environment in the EMEA region. The campaign did not utilize conventional malware distribution methods, indicating a shift in tactics. Current status updates on the incident are not provided in the articles. 3 sources 52

Extracted Entities

Hackers Use Fake Google Gemini Installer to Deploy Vidar Stealer and Steal Browser Credentials

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)