Attackers tricked a user into downloading a fake “Google Gemini” Windows installer by using a Google Colab page that looked trustworthy and then redirecting to a spoofed software download site. The downloaded file delivered the Vidar infostealer, which is commonly used to steal browser-stored passwords and other sensitive data.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You search for “Google Gemini for Windows,” click the top result, and it’s on Google Colab… so it feels safe, right? But that Colab page silently bounces you to a fake 'Windows Software Hub' site, serving a file called Download_Google_Gemini_For_Windows.exe that’s actually the Vidar infostealer, built to rip passwords from your browser. The ZIP even includes a README telling you to run it as administrator and add it to your antivirus exclusions. That’s the aha moment: legit installers don’t beg you to weaken your defenses just to 'make it work.' If you ever see AI tool installers from Colab, random 'software hubs,' or READMEs asking for admin and AV exceptions, stop and send the link or file to IT or security before you touch it.
Researchers described an active phishing operation using real DocuSign notifications to trick employees into opening a fake “remittance-advice” document and clicking a hidden malicious link. The attack routes victims through legitimate Microsoft/Google pages before landing on an…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers observed LogoKit phishing campaigns that create a unique fake login page for each recipient in real time. The kit pulls a live screenshot of the victim organization’s real website and uses legitimate online services to make the phishing page look familiar, then steals credentials and…
Researchers observed insurance-themed phishing that doesn’t just steal passwords, it hijacks accounts in real time while the victim is actively logging in. The attack often starts with sponsored Google ads that lead to convincing fake insurance portals, which immediately prompt victims for one-time…
Researchers documented a real macOS data-stealing campaign that relies on social engineering instead of software bugs. Victims are sent to a fake “verification” page that tells them to copy and paste a command into Terminal, which silently installs a stealer and then pressures them to enter their…
