Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
4 IOCs

Hackers Use Fake Google Gemini App to Steal Windows Users’ Browser Credentials

Cyber Press
Cyber Press
Published August 21, 2026Original Report

Malware Families

Excerpt

Threat actors are increasingly abusing the growing popularity of generative AI tools to spread malware. In a recent incident observed by Darktrace, attackers used a fake Google Gemini installer to infect a Windows device with the Vidar information stealer. The campaign targeted users actively looking for AI software rather than relying on traditional phishing emails. The malicious file was named Download_Google_Gemini_For_Windows.exe and appeared to offer a Windows version of…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREmicronsoftwares.comdtm.kijangturbo88.top91.98.98.86CAPABILITYVidarVICTIMunknown
Adversary
Infrastructure(4)
Capability(1)
Victim

Indicators of Compromise

Open the mindmap →

4 indicators

TypeIndicatorConfidenceScoreFirst Seen
Domainmicronsoftwares.comHighScore 71/100First seen
Domaindtm.kijangturbo88.topHighScore 58/100First seen
IP91.98.98.86HighScore 58/100First seen
IP91.98.111.49HighScore 58/100First seen

IOC Relationship Graph

Building graph…