Hackers Use Fake Google Gemini Installer to Deploy Vidar Stealer and Steal Browser Credentials
Brief
Cybercriminals are abusing interest in generative AI to trick users into downloading malware. In a newly documented incident, a file posing as a Google Gemini installer delivered the Vidar information stealer, putting saved browser passwords and other sensitive data at risk.
The attack did not begin with a phishing email. Instead, it relied on a normal-looking software search and download path, showing how criminals can turn routine searches for AI tools into a route for credential theft.
The tactic mirrors recent campaigns that used fake AI installers and search manipulation to distribute password-stealing malware. Hackers using fake Claude pages have similarly shown how convincing AI-themed downloads can mislead users.
Analysts from Darktrace identified the activity in July 2026 within a customer environment in the Europe, Middle East and Africa region.