Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
Hackers Use Fake Google Gemini App to Steal Windows Users’ Browser Credentials
Malware Families
Excerpt
Threat actors are increasingly abusing the growing popularity of generative AI tools to spread malware. In a recent incident observed by Darktrace, attackers used a fake Google Gemini installer to infect a Windows device with the Vidar information stealer. The campaign targeted users actively looking for AI software rather than relying on traditional phishing emails. The malicious file was named Download_Google_Gemini_For_Windows.exe and appeared to offer a Windows version of…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | micronsoftwares.com | High | Score 71/100 | First seen |
| Domain | dtm.kijangturbo88.top | High | Score 58/100 | First seen |
| IP | 91.98.98.86 | High | Score 58/100 | First seen |
| IP | 91.98.111.49 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…