Fake Gemini Installer Delivers Vidar Infostealer via Google Colab Lure
Threat actors are distributing the Vidar infostealer through a malicious installer disguised as Google Gemini, leveraging Google Colab for distribution and targeting credentials.
Cybercriminals are employing a sophisticated social engineering tactic to distribute the Vidar infostealer, masquerading a malicious executable as a legitimate Google Gemini installer. Researchers at Darktrace uncovered this campaign, which utilizes Google Colab, a platform commonly used by developers and data scientists, as a hosting ground for the malware. This deceptive approach aims to exploit the growing interest in AI tools like Gemini to trick unsuspecting users into downloading and executing the malware.
The initial lure involves a search result pointing to a file hosted on Google Colab. By leveraging this trusted Google platform, attackers increase the perceived legitimacy of the download. From the Colab page, users are redirected to a second site, posing as a "Windows Software Hub," where the malicious file, named Download_Google_Gemini_For_Windows.exe, is available for download. Darktrace observed SSL connections to Google Colab immediately preceding the execution of the malicious file, indicating the user visited the Colab page before being directed to the download site.
Once downloaded, the ZIP archive containing the fake installer reportedly included a README file instructing victims to run the executable with administrator privileges and to add it to their antivirus exception list. This is a common tactic to bypass security controls and ensure the malware can operate undetected. The malware itself is identified as a newer variant of the Vidar infostealer, compiled using the Go programming language, and communicates with command-and-control (C2) infrastructure hosted on Telegram.
The Vidar infostealer is designed to target and steal sensitive information from infected systems, with a particular focus on browser credentials. This includes usernames, passwords, cookies, and other authentication tokens stored by web browsers. The stolen data can then be used for further malicious activities, such as identity theft, unauthorized access to online accounts, and financial fraud. The campaign's success hinges on the user's trust in the Google brand and the perceived legitimacy of the Gemini software.
While the Vidar malware itself is not novel, the delivery mechanism and lure employed in this campaign are noteworthy. The attackers' ability to leverage a trusted platform like Google Colab and impersonate a popular AI tool demonstrates an evolving threat landscape where social engineering and platform abuse are increasingly common. The campaign was detected on a company network in the EMEA region, suggesting a targeted attack rather than a broad, indiscriminate distribution.
Darktrace's Autonomous Response system successfully intervened by blocking communication with the malicious infrastructure and quarantining the infected device. The detection was triggered by a deviation from the device's normal behavior, even though the initial download appeared to be a routine software installation. This highlights the importance of behavioral analysis in detecting sophisticated threats that might evade signature-based antivirus solutions.
As AI adoption accelerates, security researchers urge organizations to remain vigilant against campaigns that exploit this trend. Attackers are likely to continue using fake applications, manipulated search results, and the misuse of trusted platforms to distribute malware. Staying informed about these evolving tactics and implementing robust security measures, including endpoint detection and response (EDR) and network traffic analysis, is crucial for defending against such threats.