Attackers tricked a user into downloading a fake “Google Gemini” Windows installer by using a Google Colab page that looked trustworthy and then redirecting to a spoofed software download site. The downloaded file delivered the Vidar infostealer, which is commonly used to steal browser-stored passwords and other sensitive data.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You search for “Google Gemini for Windows,” click the top result, and it’s on Google Colab… so it feels safe, right? But that Colab page silently bounces you to a fake 'Windows Software Hub' site, serving a file called Download_Google_Gemini_For_Windows.exe that’s actually the Vidar infostealer, built to rip passwords from your browser. The ZIP even includes a README telling you to run it as administrator and add it to your antivirus exclusions. That’s the aha moment: legit installers don’t beg you to weaken your defenses just to 'make it work.' If you ever see AI tool installers from Colab, random 'software hubs,' or READMEs asking for admin and AV exceptions, stop and send the link or file to IT or security before you touch it.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers observed LogoKit phishing campaigns that create a unique fake login page for each recipient in real time. The kit pulls a live screenshot of the victim organization’s real website and uses legitimate online services to make the phishing page look familiar, then steals credentials and…
Researchers observed insurance-themed phishing that doesn’t just steal passwords, it hijacks accounts in real time while the victim is actively logging in. The attack often starts with sponsored Google ads that lead to convincing fake insurance portals, which immediately prompt victims for one-time…
Researchers documented a real macOS data-stealing campaign that relies on social engineering instead of software bugs. Victims are sent to a fake “verification” page that tells them to copy and paste a command into Terminal, which silently installs a stealer and then pressures them to enter their…
Google says three suspected Russian cyber-espionage groups are running highly targeted phishing campaigns against people in government, academia, defense, and think tanks in the US and Europe. A key theme is abusing legitimate Google/Microsoft OAuth login flows so the outreach looks real, tricking…
This report describes real-world social engineering where victims are tricked into copying and pasting commands that install malware on macOS and Windows. It also highlights device code phishing activity targeting Microsoft Entra ID/Microsoft 365 tokens, enabling attackers to access accounts and…
