Hackers Use Fake Google Gemini App to Steal Windows Users’ Browser Credentials
Brief
Threat actors are increasingly abusing the growing popularity of generative AI tools to spread malware. In a recent incident observed by Darktrace, attackers used a fake Google Gemini installer to infect a Windows device with the Vidar information stealer.
The campaign targeted users actively looking for AI software rather than relying on traditional phishing emails.
The malicious file was named Download_Google_Gemini_For_Windows.exe and appeared to offer a Windows version of Google Gemini.
Darktrace detected suspicious activity after the executable launched from a user’s Downloads folder in an organization in the Europe, Middle East and Africa region in July 2026.
Fake Gemini Steals Credentials
Investigators found that searches for the suspicious filename led to a Google Colab page.