Cybersecurity researchers have identified a new campaign distributing the Vidar infostealer through a deceptive Google Gemini installer, leveraging Google Colaboratory (Colab) as part of its delivery mechanism. The attack, observed targeting a company in the EMEA region, exploited user interest in AI software by masquerading a malicious executable as a legitimate Google Gemini application.
The campaign began with a Google Colab page, a cloud-based Jupyter notebook platform, which was used to host a download prompt for the fake Gemini installer. This tactic aimed to enhance the perceived legitimacy of the download, as Google Colab is a trusted platform frequently used by developers and researchers. The Colab page then redirected users to a secondary site, branded as a "Windows Software Hub," where the malicious file, named Download_Google_Gemini_For_Windows.exe, was available for download.
Analysis of network activity showed SSL connections to Google Colab immediately preceding the execution of the malicious file, indicating that users likely encountered the Colab page before being directed to the download site. The downloaded file was a ZIP archive that reportedly included a README file, instructing victims to run the executable with administrator privileges and to add it to their antivirus exception lists.
The malware was identified as a newer Go-compiled variant of the Vidar infostealer. This variant communicated with command-and-control infrastructure hosted on Telegram, using dtm[.]kijangturbo88[.]top as its endpoint. The primary objective of the infostealer was to exfiltrate browser credentials and other sensitive data from the compromised machines.
While the Vidar malware itself is not novel, the researchers noted that the specific lure and delivery mechanism employed in this campaign were. The use of a trusted platform like Google Colab, combined with manipulated search results and the appearance of a routine software download, made the attack particularly convincing.
The incident was detected due to deviations from the infected device's normal behavioral patterns. Following detection, an autonomous response system was able to block communications with the malicious infrastructure and quarantine the affected device. This incident highlights the growing trend of cybercriminals exploiting interest in artificial intelligence through fake applications and the misuse of legitimate platforms.
