Fake Gemini installer delivers Vidar infostealer via Google Colab lure

Darktrace investigated a campaign that used a fake “Google Gemini” installer hosted via Google Colab and a redirect to a malicious site to deliver a Go-compiled Vidar infostealer. The ZIP included instructions to run the executable as admin and exclude it from antivirus; the malware contacted Telegram-based C2 at dtm.kijangturbo88.top and focused on stealing browser credentials. Darktrace’s systems detected anomalous behavior, blocked C2 communications, and quarantined the infected host, highlighting the misuse of trusted platforms and AI-themed lures.