Attackers are turning the rush to download AI tools into a credential-theft funnel.
Darktrace says it investigated a July 2026 incident in which a malicious Windows executable pretended to be a Google Gemini installer, then delivered the Vidar information stealer on a customer network in the Europe, Middle East, and Africa region.
The headline is easy to misread. This was not a report that Gemini itself was compromised. The danger was the wrapper around Gemini's brand: a search-driven software download path, a Google Colab-hosted lure, and a fake installer that looked close enough to a normal AI tool setup for a user to run it.
That makes the incident more useful than a one-off malware note. It shows how attackers are adapting old fake-installer tactics to the new habits created by AI adoption.
What Darktrace Saw
Darktrace first noticed unusual activity after a suspicious file launched from a user's Downloads folder. The file was named Download_Google_Gemini_For_Windows.exe, a plain enough name to look like the kind of installer someone might expect after searching for a desktop AI assistant.
When Darktrace investigated the surrounding activity, it found that a top search result for the filename pointed to a Google Colab page. Colab is a legitimate Google-hosted notebook platform used by developers, researchers, and students, which gave the lure a layer of borrowed trust.
The Colab page displayed a download prompt, then redirected users to a second site posing as a "Windows Software Hub." That site offered the fake Gemini installer.
Darktrace was careful about one point: it did not recover enough HTTP or file-download telemetry to prove every step of the download chain conclusively. But it did observe SSL sessions to Google Colab immediately before the executable ran, which strongly suggests the user interacted with the Colab resource before reaching the secondary download site.
At the time Darktrace reviewed the campaign on July 15, the Colab page was still active and serving a ZIP archive that contained the malicious binary.
The Social Engineering Was Loud
The ZIP archive also appeared to include a README file telling the user to run the binary with administrator privileges and add it to antivirus exception lists.
That should set off alarms for any security team. Legitimate software almost never needs the user to weaken endpoint protection as part of installation. But the instruction also shows why this class of attack works: the malware is wrapped in a task the user already wants to complete.
The victim is not thinking, "I am running malware." They are thinking, "I am installing the AI tool everyone is talking about."
That is the shift. Attackers no longer need to invent obscure business pretexts when employees are already searching for AI assistants, coding tools, browser extensions, and productivity add-ons. Popular AI brands provide the lure. Trusted developer platforms provide the stage. Search results provide the delivery path.
What Vidar Tried To Steal
Darktrace identified the executable as a newer Go-compiled Vidar variant. Vidar is an information stealer, a malware family built to collect useful data from infected systems rather than immediately encrypt files or visibly disrupt the machine.
In this case, Darktrace says the binary communicated with Telegram-based infrastructure and identified dtm[.]kijangturbo88[.]top as a command-and-control endpoint. It also observed suspicious connections to external infrastructure, including 91.98.98[.]86 over port 443, and later identified 91.98.111[.]49 through SSL telemetry.
The most important practical risk was browser credential theft.
A later alert from the customer's Microsoft Defender for Endpoint integration confirmed activity consistent with theft of browser credentials and other sensitive data from the affected endpoint. That means saved passwords, browser session material, and adjacent account data could become useful to an attacker even if no password was guessed.
For a business, that can be worse than a single infected laptop. Browser credentials often lead outward: email, cloud dashboards, CRM accounts, GitHub, internal SaaS tools, ad accounts, banking portals, and admin consoles.
The fake installer is the first step. The stolen browser data is the real prize.
How It Was Contained
Darktrace says its Autonomous Response system blocked communication with suspicious external infrastructure and quarantined the compromised device.
The interesting part is what triggered the response. The campaign leaned on familiar branding and a legitimate Google service, but the endpoint's behavior after execution still deviated from its normal pattern. A new executable in Downloads making rare encrypted connections and showing signs of credential theft is the kind of signal defenders can act on even when the download page itself looks plausible.
That is why this story sits at the intersection of AI adoption and ordinary endpoint security. The malware was not novel, according to Darktrace. The delivery path was.
Why AI Brands Are Becoming Malware Bait
Fake installers have been around for years. Attackers have abused Google Ads, cloned software pages, typosquatted domains, cracked-app searches, and fake browser updates for a long time.
AI changes the target pool.
Employees now have a reason to search for tools they have never installed before. They may not know whether a given AI product has a Windows desktop app, a Chrome extension, a web-only version, an enterprise download, or a third-party wrapper. That uncertainty creates room for attackers to place a convincing fake in the path.
There is also organizational pressure. Teams are experimenting with AI under time pressure, and some users will try a tool before procurement, IT, or security has evaluated it. That creates a shadow-AI download surface where normal software controls may lag behind behavior.
The Gemini branding made this campaign believable. Colab made it look more technical and more legitimate. The secondary "Windows Software Hub" completed the fake installation story.
That pattern can be reused with almost any popular AI name.
What Users Should Do
The practical advice is simple: do not download AI tools from search results that route through notebooks, file-sharing pages, unknown software hubs, or ZIP archives with strange setup instructions.
Use official product pages, verified app stores, company software catalogs, or direct links from your IT team. If a README tells you to run an installer as administrator and add it to antivirus exclusions, stop.
For Gemini specifically, be cautious of random Windows installer claims. Google provides Gemini through official Google surfaces, mobile apps, browser access, and workspace integrations. A standalone executable found through a third-party download page should be treated as hostile unless your organization has verified it.
What Security Teams Should Watch
Security teams should treat AI-themed downloads as a live malware-delivery category, not as a novelty.
Useful detections include new executables launched from Downloads folders, archive contents that instruct users to weaken antivirus protections, rare SSL connections after first execution, suspicious credential-store access, and outbound traffic from a new process to unfamiliar infrastructure.
The Darktrace indicators are also worth checking in controlled systems:
Download_Google_Gemini_For_Windows.exeGoogleAppInstaller.exe91.98.98[.]8691.98.111[.]49dtm[.]kijangturbo88[.]top1e13c2c9eac72daf63fd00a9946878949e159ae6ec51b54ec64f942d79d61913
The broader control is software provenance. If employees are adopting AI tools, give them a sanctioned path to find and install approved ones. Leaving people to search the open web for "Gemini for Windows" or "AI assistant download" is exactly the gap attackers want.
Our Take
The fake Gemini installer case is a reminder that AI security is not only about jailbreaks, model behavior, or data retention policies.
Sometimes the AI risk is simpler: people want AI tools, attackers know it, and a convincing installer can turn that demand into credential theft.
The defensive lesson is not to panic about Gemini. It is to close the gap between AI curiosity and software trust. As AI products multiply, organizations need a clearer answer to a basic employee question: where do I safely get this tool?
If the answer is "search for it," attackers will keep supplying the download.