A malware campaign uncovered by Darktrace shows infostealer operators are getting more comfortable weaponizing trusted cloud platforms rather than building their own infrastructure from scratch. The campaign used a fake Google Gemini installer, hosted through a legitimate Google Colab page, to deliver the Vidar infostealer to victims searching for the AI assistant’s Windows software.
Users landed on a Colab page that redirected to a fake “Windows Software Hub” offering a download called Download_Google_Gemini_For_Windows.exe. The archive’s own instructions told victims to run the file with administrator privileges and add it to their antivirus exclusion list, a step that only works because the initial lure arrived on infrastructure the browser and the user already implicitly trust. Once installed, this Go-compiled Vidar variant harvested browser-stored credentials and other sensitive data, communicating with a Telegram-linked command-and-control domain. Darktrace said “by leveraging another trusted Google platform, the attacker increased the likelihood that users would perceive the download as legitimate, making the lure more convincing to those searching for Gemini-related software.”
The original insight for defenders is less about Vidar, which is a known and widely tracked stealer family, and more about the delivery mechanic. Hosting the lure on Google Colab means the initial click happens on a domain most web filtering and user-awareness training treats as safe by default, the same trust-transfer problem that makes browser-based malware delivery chains hard to catch with domain reputation alone. Security teams should treat “hosted on a major cloud platform” as a neutral signal, not a positive one, when triaging download-based alerts, and should specifically flag AV-exclusion instructions bundled with any installer as a near-automatic red flag regardless of the source domain’s reputation. This campaign also lands amid a broader spike in credential theft: infostealers alone harvested 1.7 billion credentials in the first half of the year, and lures riding trusted platforms are a big part of why that number keeps climbing.
Source: Darktrace
