Hackers Use Fake Google Gemini Installer to Deploy Vidar Stealer and Steal Browser Credentials

Cybersecuritynews •Tushar Subhra Dutta • August 21, 2026

Cybercriminals are abusing interest in generative AI to trick users into downloading malware. In a newly documented incident, a file posing as a Google Gemini installer delivered the Vidar information stealer, putting saved browser passwords and other sensitive data at risk. The attack did not begin with a phishing email. Instead, it relied on a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fake Google Gemini Installer Distributes Vidar Infostealer via Google Colab A malicious executable disguised as a Google Gemini installer was used to deploy the Vidar infostealer on a company network in the EMEA region. Darktrace researchers reported that a user downloaded and executed a file named Download_Google_Gemini_For_Windows.exe, which was hosted on Google Colab. This incident, which occurred in July 2026, highlights the exploitation of interest in generative AI software by threat actors. The attack method involved social engineering to lure users into executing the malicious file. The scope of the impact remains unclear, but it specifically targeted a customer environment in the EMEA region. The campaign did not utilize conventional malware distribution methods, indicating a shift in tactics. Current status updates on the incident are not provided in the articles. 3 sources 52

Extracted Entities

Hackers Use Fake Google Gemini Installer to Deploy Vidar Stealer and Steal Browser Credentials

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)