Loading story…
Attackers are abusing interest in Google’s Antigravity AI tool with a typosquatted site, google-antigravity[.]com, that serves a trojanized installer containing the real application plus a hidden PowerShell stage. Researchers said the downloader contacts attacker infrastructure at opus-dsn[.]com, then can deploy follow-on malware that weakens Microsoft Defender, profiles the host, creates persistence with a scheduled task, and loads encrypted .NET payloads in memory. The malware steals browser credentials, cookies, autofill data, messaging and gaming sessions, FTP credentials, and cryptocurrency wallets, while also supporting clipboard hijacking, keylogging, and covert activity on a hidden desktop.
The campaign is particularly dangerous because stolen session cookies can enable rapid account takeover without needing passwords and can sidestep MFA in many cases. Separately, Pillar Security disclosed a now-patched Antigravity vulnerability that allowed prompt injection to trigger sandbox escape and remote code execution through the native find_by_name tool by passing crafted flags to the underlying fd utility before Secure Mode restrictions were enforced. Google patched the flaw on February 28 after responsible disclosure, but the combined reports show Antigravity is being targeted both through malicious lookalike downloads and through weaknesses in agentic tool execution paths.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
Researchers described the fake Antigravity download campaign's second-stage malware, which can weaken Microsoft Defender, establish persistence, steal browser sessions and credentials, target crypto wallets, and enable clipboard hijacking and keylogging.
Attackers used the lookalike domain google-antigravity[.]com to distribute a repackaged Antigravity installer that also launched hidden PowerShell code to contact attacker infrastructure at opus-dsn[.]com.
Pillar Security and CyberScoop publicly disclosed details of the now-patched Antigravity vulnerability, explaining how prompt injection and file-creation features could be chained into sandbox escape and remote code execution.
After fixing the issue, Google awarded Pillar Security a vulnerability reward for the Antigravity finding.
Google fixed the reported Antigravity vulnerability, closing the path that allowed prompt injection to escape sandbox protections and execute code.
Google acknowledged the Antigravity bug on January 7 and accepted the report on January 24 as a valid vulnerability affecting the tool's protections.
Pillar Security reported a prompt-injection vulnerability in Antigravity to Google that could bypass Secure Mode and lead to arbitrary code execution through the native find_by_name tool.
Google's Antigravity tool became available in November 2025, creating the product interest later exploited by both security researchers and threat actors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcemalwarebytes.com
Open sourcecyberscoop.com
Open sourcepillar.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers abused ChatGPT Custom GPT pages branded as **“Plus 5.6”** and promoted them through sponsored Google Search results to impersonate a legitimate ChatGPT model. Victims were redirected to a fake backup domain hosting a Google Sites page styled as ChatGPT and Cloudflare verification prompts; the ClickFix lure instructed them to run PowerShell, silently installing a malicious MSI and a sophisticated remote-access trojan (RAT). Huntress handled at least 40 incidents tied to the Google Sites domain, including two confirmed infections originating from Custom GPT lures, and observed replacement lures after the original was removed. The campaign used signed third-party software for DLL sideloading and layered persistence. An initial variant abused Canon-signed CaptureOnTouch components, concealed its loader in a WAV file, and created Run-key and scheduled-task persistence labeled **“Canon Configuration Reader.”** A second variant preserved the RAT framework but used Stardock-signed `DeElevate64.exe`, a modified `DeElevator64.dll`, and a NuGet package carrier, establishing persistence as **“Stardock DeElevation Tool.”** Organizations should treat sponsored AI-tool search results and browser verification prompts that require shell commands as high-risk social-engineering activity.
Oct 1, 2026
Threat actors are abusing interest in AI developer tools by impersonating installers and setup guides to trick users into executing malware. Fake installation-guide pages for Anthropic’s **Claude Code** were promoted via **Google Ads** to rank highly for searches like “Claude Code install/CLI,” leading Windows and macOS users to run copy-pasted commands in an **InstallFix** campaign (a variant of **ClickFix**) that ultimately deployed **Amatera** (an **ACR Stealer**-based MaaS infostealer). Push Security reported the malware steals browser-stored credentials, cookies, session tokens, and system information, and the infrastructure used legitimate hosting/CDN services (e.g., *Squarespace*, *Cloudflare Pages*, *Tencent EdgeOne*) to reduce suspicion. In a related AI-tool impersonation theme, JFrog identified a malicious **npm** package, `@openclaw-ai/openclawai`, posing as an **OpenClaw** installer that targets macOS users to steal credentials and establish persistent remote access. The package uses a `postinstall` hook to reinstall itself globally and registers a CLI via the `bin` field pointing to `scripts/setup.js`, which presents a fake installer UI and then prompts for the user’s system password via a bogus Keychain/iCloud authorization flow. The malware (self-identified as **GhostLoader**) was reported to collect browser data, crypto wallets, SSH keys, Apple Keychain databases, and iMessage history, while also deploying a **RAT** with **SOCKS5 proxy** capability and “live browser session cloning,” indicating a blend of credential theft and long-term access objectives.
Aug 21, 2026
Attackers are increasingly impersonating popular AI brands to deliver malware and steal credentials, with Sophos reporting that fake installers and malicious browser extensions tied to names such as **ChatGPT**, **Claude**, **Copilot**, **Perplexity**, and **Gemini** now account for a significant share of confirmed AI-related incident cases. In a 12-month review of 86 MDR cases tagged for suspected AI activity, Sophos confirmed 38 as genuine adversarial AI incidents; 35 involved malicious targeting of AI, and 30 specifically involved AI software impersonation. The company said it found no confirmed cases of fully AI-orchestrated intrusions in its telemetry, indicating that the dominant threat remains conventional social engineering wrapped in AI branding. One recent case investigated by Darktrace used a fake **Google Gemini** installer to deploy the **Vidar** infostealer inside an EMEA company network. The campaign abused **Google Colab** as a trust-building lure before redirecting the victim to a fake "Windows Software Hub" page hosting `Download_Google_Gemini_For_Windows.exe`; the payload was a newer Go-compiled Vidar variant using Telegram-based infrastructure and the command-and-control domain `dtm[.]kijangturbo88[.]top`. Darktrace said the malware activity was consistent with browser credential theft and other data theft, and that it blocked the outbound communications and quarantined the affected device, underscoring the need for verified software sources, browser extension controls, supply-chain review, and better visibility into unmanaged systems.
Aug 21, 2026