Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Tyler Fornes
Senior Security Analyst at Expel
Share
11
Mar 2019
The following guest-authored blog post examines an advanced cyber-threat discovered by Darktrace on a customer’s network.
At Expel — a managed security provider — our analysts get to use a lot of really cool technologies every day, including Darktrace. Given its popularity among our customers, we thought it would be useful to demonstrate how Darktrace helps us identify and triage potential security threats.
Take a look at this alert. It was triggered via a violation of one of the pre-packaged model breaches for Device / AT Service Scheduled Task.
To triage this specific alert, we need to answer the following questions:
What were the triggers that caused the model to alert?
Which host was the Scheduled Task created on?
Were any files transferred?
Is this activity commonly seen between these hosts?
By answering these questions, we can determine whether or not this alert is related to malicious activity. First, we need to gather additional evidence using the Darktrace console.
At this point, we know the model breach Device / AT Service Scheduled Task was triggered. But what does that mean? Let’s view the model and explore the logic.
Looking at the logic behind this model breach, we see that any message containing the strings “atsvc” and “IPC$” will match this model breach. And because the frequency has been set to “> 0 in 60 mins,” we can assume that once this activity is seen just one time, it’ll trigger an alert. By understanding this logic, we now know:
Next, let’s grab some data. We opened the Model Breach Event Log to see the related events observed for this model breach. There was a successful DCE-RPC bind, followed by SMB Write/Read success containing the keywords “atsvc” and “IPC$.”
We turned to the View advanced search for this event feature of the Model Breach Event Log for even more info.
The advanced search results for this model breach revealed two distinct messages. There’s a successful NTLM authentication message for the account “appadmin.” Since NTLM is commonly used with SMB for authentication, this is likely the account being used by the source machine to establish the SMB session.
Immediately after this authentication, we see the following DCE-RPC message for a named pipe being created involving atsvc:
We see that the RPC bind was created referencing the SASec interface. Based on a quick online search, we learned that the SASec interface “only includes methods for manipulating account information, because most SASec-created task configuration is stored in the file system using the .JOB file format0.”
One possible explanation for this connection is that it was made to query information about a scheduled task defined within the .JOB format, rather than a new scheduled task being created on the host. However, Darktrace doesn’t show any messages mentioning a file with the extension “.JOB” within this model breach. So we kept digging for answers.
By querying “*.JOB AND SMB” within the timeframe of the activity we’ve already observed, some promising results appeared:
We observed three unique .JOB files being accessed over SMB during the exact time of our previous observations. Considering the hosts and the timeframe, we correlated this activity to the original model breach.
So we know the following:
To answer the last investigative question, we used the query “AV.job AND SMB” over the past 60 days. This query returned daily entries for identical activity dating back several months. The activity occurred around the same time each day, involving the same hosts and file paths.
This was starting to smell like legitimate activity, but we still wanted to analyze the contents of the requested file AV.job. We created a packet capture for a five-minute window around the timeframe of the source IP address observed in the model breach.
Once we collected the PCAP, we downloaded and analyzed it in Wireshark, and then extracted the transferred files using the Export Objects feature.
The contents of this file refer to an executable in the location C:\Program Files\Sophos\Sophos Anti-Virus\BackgroundScanClient.exe. Judging by the name of the .JOB file this was found in, it was likely a legitimate scheduled task created to perform an antivirus scan on the endpoint each morning.
Reviewing our original analysis questions, we could confidently answer all four questions:
Darktrace’s cyber defense platform allowed our analysts to quickly confirm and scope potential threat activity and identify network-based indicators (NBIs) related to an attack. It can also generate additional, host-based indicators (HBIs) to supplement your investigation. In summary, Darktrace AI enables our Expel analysts quickly and efficiently scope an incident or hunt for threats across the entire organization — without the need for exhaustive data collection and offline parsing by an analyst.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AI Agents: Securing the Path from Intent to Action
The UK’s National Cyber Security Centre (NCSC) recently published guidance on managing the cyber risk of agentic AI. While the document is framed as interim advice as more formal guidance is developed, the framing reflects the current state of the industry: organizations are already deploying agents into production environments while standards, controls, and operating models for autonomous systems remain unsettled. Governance is evolving alongside adoption rather than preceding it, a reality which underscores the importance of robust controls.
The NCSC’s guidance recommends aligning controls to an agent's level of autonomy, assigning distinct identities, limiting permissions, constraining access to systems and data, monitoring activity, maintaining human oversight, and preserving the ability to intervene when necessary. Most of these recommendations will sound familiar to security teams. The challenge is not the novelty of the controls. It is the type of system those controls now need to govern.
The shift from model security to agent security
For several years, AI security discussions have focused heavily on models. Can a model be manipulated? Jailbroken? Trusted? Can it expose information it should not? Those questions remain important, but they capture only part of the problem. A model generating text is one thing. A system connected to identities, applications, tools, workflows, and business data is another.
The difference becomes clearer when comparing a chatbot that answers questions with an agent that can retrieve customer records, update tickets, invoke tools, trigger workflows, and interact with external systems. The underlying model may be identical. Its access is not. The security question begins to shift from what the model knows to what the system can do.
The same theme appears in the Five Eyes statement released earlier this year, describing AI as a force multiplier that is accelerating both offensive and defensive cyber operations. The NCSC guidance explores what that reality looks like when autonomous systems begin operating inside enterprise environments.
Securing AI agents in operation
The NCSC spends relatively little time debating model behavior and considerably more time discussing identity, permissions, monitoring, oversight, containment, and response. Agents are treated as participants within an environment rather than isolated pieces of technology.
That's broadly consistent with how we think about the problem at Darktrace.
An agent should not be treated as an extension of a user account. It develops its own behavioral patterns. It accesses systems, interacts with data, invokes tools, and moves across workflows in ways that can be observed independently. Understanding what an agent is permitted to do matters. Understanding how it actually behaves once deployed, and whether that behavior aligns with business intent, matters just as much.
Identity provides an obvious example. The NCSC recommends assigning distinct identities to agents rather than allowing them to disappear into surrounding human or service accounts. Most importantly, assigning agents distinct identities enables independent behavioral monitoring.
Development assumptions vs. real-world behavior
The same principle extends to monitoring. NCSC guidance places agent activity within normal security operations rather than treating it as a separate AI governance function. Many of the controls described are put in place before an agent begins operating. Sandboxing, credential design, approval workflows and human oversight all reflect judgments about how the system is expected to behave and what risks it is likely to create.
Actual use may challenge those assumptions. Access patterns change. Workflows expand. Systems begin interacting with resources they have never touched before. Processes that appeared reasonable during design behave differently in production. Human oversight requirements may turn out to be either excessive or inadequate once the system is operating at scale and operating within the context of unique business processes.
The Five Eyes statement points to a similar issue: organizations need confidence that controls continue to work as intended once systems are exposed to real users, data, tools and operational pressures. Often, the question is not whether an agent is technically allowed to perform an action, but whether its behavior remains consistent with the role it was intended to play.
Monitoring and governance of AI agents go hand-in-hand
This problem is exactly why monitoring and governance should be treated as part of the same process. Governance sets the initial parameters for deployment, while monitoring provides evidence about whether those parameters remain appropriate. That evidence should, in turn, inform changes to permissions, controls and oversight.
This matters increasingly as autonomous systems are integrated into business processes. The relevant risk is shaped not only by the model or agent itself, but by what it can access, what actions it can take, and how its behavior changes in practice.
Developing continuous oversight of AI agent behavior
The implication is clear: governance cannot end at deployment. Organizations need a way to understand how agents behave after deployment, test whether controls remain appropriate, and adjust them as conditions change. That requires visibility not just into technical activity, but into whether that activity makes sense in the context of the business process the agent is intended to support.
This is where business-centric behavioral security can become critical. Risk does not emerge from the model itself: it emerges from the actions an autonomous system takes within the enterprise and the downstream consequences of those actions.
An agent can operate exactly as intended and still create risk if it accesses sensitive information in an unexpected context, exercises permissions in ways that create unintended exposure, or influences business processes in ways that were not anticipated during design and review.
Traditional governance vs. behavioral analytics
Traditional governance frameworks provide assurance at a point in time. Behavioral security can provide ongoing visibility into how autonomous systems interact with the organization they are meant to serve. Rather than focusing exclusively on model performance or policy compliance, organizations need to understand whether an agent's behavior aligns with business intent, operational expectations, and acceptable risk tolerances as conditions change.
As enterprises move from isolated AI deployments to interconnected ecosystems of agents, visibility into behavior becomes as important as visibility into code. Governance determines what an autonomous system is permitted to do. Behavioral analytics helps determine what it is doing, what business outcomes it is producing, and whether those outcomes remain aligned with the organization's objectives.
When AI Becomes the Lure: A Fake Gemini Installer Delivers Vidar
Key takeaways
Darktrace observed a customer download a fake Google Gemini installer hosted on Google Colab, resulting in the execution of the Vidar information stealer.
Darktrace identified the compromise through behavioral indicators, including suspicious process activity, anomalous network communications, and indicators of credential theft, before autonomously containing the threat.
The incident highlights how threat actors are increasingly exploiting trusted platforms and a growing interest in AI tools to distribute malware through seemingly legitimate software acquisition workflows.
The Growing Abuse of Generative AI
As organizations are increasingly adopting generative AI tools into their daily workflows, attackers are adapting their distribution methods accordingly too. As part of their day-to-day work, users are now searching for AI assistants, programming tools, browser extensions, desktop applications, and productivity integrations.
Recent reports have highlighted campaigns that use fake AI software and AI-related installers to distribute malware and steal credentials [1]. Researchers have documented campaigns that exploit fake AI-themed websites and services to distribute information stealers and backdoors [2]. Security researchers have also observed attackers disguising malware as legitimate installers for AI software to increase the likelihood of victim interaction and execution [3].
In July 2026, Darktrace observed one such case within a customer environment in the Europe, Middle East and Africa (EMEA) region, where attackers used a fake generative AI installer to deliver the prolific information stealer Vidar. This incident highlights how threat actors are exploiting interest in AI services to distribute established malware using increasingly convincing social engineering techniques.
How a Fake Gemini Installer Delivered Vidar
Initial Access: From Search Result to Malware Download
Unlike many malware campaigns that begin with a phishing email, this activity appears to have originated from a user searching for and downloading software.
Darktrace first observed unusual activity on the customer network after a suspicious executable file was launched from a user’s Download folder. Further investigation revealed that the file purported to be a Google Gemini installer and was named “Download_Google_Gemini_For_Windows.exe”.
During the initial analysis, it was noted that the top search result for the suspicious filename associated pointed to a file hosted on Google Colab, a cloud-based Jupyter notebook platform, commonly used by developers, researchers, and data scientists to run code and machine learning workloads through a web browser. By leveraging another trusted Google platform, the attacker increased the likelihood that users would perceive the download as legitimate, making the lure more convincing to those searching for Gemini-related software.
Figure 1: The Google Colab page containing a download prompt for the fake Google Gemini installer.
Further investigation of the Google Colab page revealed that the download prompt redirected users to a secondary site, hxxps://micronsoftwares[.]com, which posed as a "Windows Software Hub" download page and offered the fake Gemini installer for download.
Figure 2: The secondary website posing as a "Windows Software Hub" download page, which likely hosted the fake Gemini installer.
While the investigation did not uncover any HTTP or file-download telemetry data that conclusively identified the download source, SSL communication sessions with Google Colab were detected immediately before the suspicious file was executed. The timing of these connections suggests that the user interacted with the Colab resource before being redirected to the secondary site from which the executable was downloaded.
The user was not simply tricked into opening an email attachment; instead, the attacker embedded malicious content into a process many users would consider entirely legitimate: searching for and downloading software associated with a trusted platform.
Weaponizing Trusted Platforms
At the time of review (July 15, 2026), Darktrace's Threat Research team confirmed that the Google Colab page was still active and prompting users to download a ZIP archive containing the binary file.
The archive also appeared to contain a README file instructing users to run the binary file with administrator privileges and add it to their antivirus software’s exception lists. These instructions suggest that the campaign relied heavily on social engineering, convincing users to take actions that would facilitate malware execution and potentially bypass security checks.
The use of a legitimate platform also complicates the user’s decision-making. Downloads associated with a trusted service are often perceived as less suspicious than those hosted on unfamiliar domains. When combined with the branding of a widely used AI tool, the lure becomes even more convincing.
Malware Analysis
Darktrace’s Threat Research team identified the executable file as the information-stealing malware Vidar. Analysis revealed that the binary file was a newer Go-compiled variant that communicated with Telegram-based infrastructure. Darktrace’s researchers also identified dtm[.]kijangturbo88[.]top as a command-and-control (C2) endpoint associated with the activity. While the malware itself was not novel, the lure and delivery mechanism was.
Figure 3: Darktrace’s detection of the unusual outbound connection associated with the fake Gemini installer.
Shortly after execution, the process established communications with the external IP address 91.98.98[.]86 via port 443, directly linking the executable to suspicious network activity observed on the device. Subsequent open-source intelligence (OSINT) analysis of the revealed multiple malicious associations [5].
Additional Darktrace detections included unusual SSL activity from the affected device. Analysis of related SSL telemetry identified 91.98.111[.]49 as additional infrastructure associated with the activity [6].
Subsequent alerts from the customer's Microsoft Defender for Endpoint integration later confirmed activity consistent with the theft of browser credentials and other sensitive data from the affected endpoint.
Taken together, these detections provided a clear picture of the attack, from the execution of a suspicious file and unusual network connections to indicators of C2 activity and credential theft.
Figure 4: Darktrace’s detection of anomalous activity following the execution of the fake Gemini installer, seen in the Model Alert Event Log.
Darktrace's Autonomous Response
Following the detection, Darktrace’s Autonomous Response took immediate containment action, including blocking communication with suspicious external infrastructure, including 91.98.98[.]86, and quarantining the compromised device.
Despite the apparent legitimacy of the activity, with the installer hosted on a trusted platform and resembling a routine software download, Darktrace was able to detect and contain the attack because the device's behavior deviated from its normal pattern.
Figure 5: Automated containment actions implemented by Darktrace's Autonomous Response following the detection of activity associated with the fake Gemini installer.
Conclusion
This investigation highlights how threat actors continue to adapt established malware delivery techniques to emerging technology trends. While the malware itself was not new, the distribution method was. By disguising Vidar as a Google Gemini installer and hosting the malicious content on a trusted platform, the attack aligned its lure with a growing behavioral trend: users actively searching for AI tools and services as part of their day-to-day work.
Although fake installers are not a new phenomenon, the rapid rise of generative AI has created new opportunities for threat actors. Rather than relying solely on traditional delivery methods, attackers can now target users who are actively searching for AI applications. As AI adoption continues to accelerate across enterprise environments, organizations should remain alert to campaigns that exploit this interest through fake applications, malicious websites, manipulated search results, the misuse of trusted platforms, and AI-themed social engineering.
Credit to Rushanth Ramanathan (Cyber Analyst) Joanna Ng (Detection Engineer)
Edited by Ryan Traill (Content Manager)
Appendices
Darktrace Model Detections
Security Integration / C2 Activity and Integration Detection
Endpoint / New Suspicious Executable Launched
Endpoint / Process Connection / Unusual Connection from New Process
