Attackers tricked a user into downloading a fake “Google Gemini” Windows installer by using a Google Colab page that looked trustworthy and then redirecting to a spoofed software download site. The downloaded file delivered the Vidar infostealer, which is commonly used to steal browser-stored passwords and other sensitive data.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You search for “Google Gemini for Windows,” click the top result, and it’s on Google Colab… so it feels safe, right? But that Colab page silently bounces you to a fake 'Windows Software Hub' site, serving a file called Download_Google_Gemini_For_Windows.exe that’s actually the Vidar infostealer, built to rip passwords from your browser. The ZIP even includes a README telling you to run it as administrator and add it to your antivirus exclusions. That’s the aha moment: legit installers don’t beg you to weaken your defenses just to 'make it work.' If you ever see AI tool installers from Colab, random 'software hubs,' or READMEs asking for admin and AV exceptions, stop and send the link or file to IT or security before you touch it.
Researchers say a new Android banking trojan (“RemControl”) tricks people into installing a fake TVTap app update from spoofed Google Play-style pages. Once installed, it persuades victims to grant Accessibility permissions, giving attackers remote control and enabling theft of banking credentials…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Researchers described an active phishing operation using real DocuSign notifications to trick employees into opening a fake “remittance-advice” document and clicking a hidden malicious link. The attack routes victims through legitimate Microsoft/Google pages before landing on an…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers observed LogoKit phishing campaigns that create a unique fake login page for each recipient in real time. The kit pulls a live screenshot of the victim organization’s real website and uses legitimate online services to make the phishing page look familiar, then steals credentials and…
