Fake Google Gemini Installer Distributes Vidar Infostealer via Google Colab

A malicious executable disguised as a Google Gemini installer was used to deploy the Vidar infostealer on a company network in the EMEA region. Darktrace researchers reported that a user downloaded and executed a file named Download_Google_Gemini_For_Windows.exe, which was hosted on Google Colab. This incident, which occurred in July 2026, highlights the exploitation of interest in generative AI software by threat actors. The attack method involved social engineering to lure users into executing the malicious file. The scope of the impact remains unclear, but it specifically targeted a customer environment in the EMEA region. The campaign did not utilize conventional malware distribution methods, indicating a shift in tactics. Current status updates on the incident are not provided in the articles.

Key Points: • A fake Google Gemini installer was used to deliver the Vidar infostealer. • The malicious file was hosted on Google Colab and targeted users in the EMEA region. • The attack exploited interest in generative AI software to lure victims.