Uncover New Malicious Email Payloads in Google Translate
Discover how threat actors are concealing malicious email payloads within Google Translate domains. Learn how Darktrace responds to these attacks effectively.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Rachel Resnekov
Cyber Analyst
Share
03
Nov 2022
Darktrace recently detected a new technique used by threat actors to deliver malicious email payloads. The malicious link was observed hidden within a legitimate domain, namely Google Translate services. To understand its abusive capabilities, it is important to first understand a benign case of how these links are created.
Google often provides a ‘Translate this page’ option for sites written in a different language to the default browser language.
Figure 1: A google search result for an international company E.g ‘Crédit Agricole’ gives the option to translate the page from French to English.
Figure 2: When clicked, the browser displays a link with a translate[.]goog domain, and the original domain, credit-agricole[.]fr, becomes the link’s subdomain.
When this feature is exploited by threat actors it can be particularly dangerous, as legacy security products that rely on ‘known’ or ‘safe’ domain-based detection are likely to register these emails as safe and provide no protective actions. If a recipient were to click on the malicious link, they could risk losing their credentials or even compromising their machine.
In contrast, Darktrace/Email has been able to consistently identify and action emails from such campaigns. This blog will discuss one of these events.
The Campaign
The apparent motive in this attack was to harvest credentials and/or deploy malware on the recipient’s device. Credential harvesting can lead to the sale of credentials on the dark web, or the attacker may choose to leverage those credentials in subsequent attacks. Both harvesting credentials and deploying malware have severe potential ramifications, including but not limited to sensitive company data leaks and financial loss.
During this attack, the threat actor sent similar emails to a group of recipients in a short space of time. The recipients were not normally associated with each other and Darktrace swiftly identified them as unsolicited bulk mail. The new technique that was leveraged included using Google’s translate services to share malicious links using legitimate seeming domains. The malicious host was visible within the subdomain ‘636416-selcdn-ru[.]translate[.]goog’.
When clicked, the link displays a google translate page stating, “Can’t translate this page”. There is then a hyperlink, “Go to original page”, that brings the user to the malicious host- 636416[.]selcdn[.]ru. Finally, the host displays a fake webmail portal login. If a user engages, the attacker can harvest their credentials to either sell or use in subsequent attacks.
Figure 3- The Google Translate page that is displayed once clicking on the full link within the email. The hyperlink at the bottom of the image is where the user is redirected by clicking “Go to original page”. It is there that the fake webmail portal login is then displayed.
Darktrace Coverage
As the malicious emails contained links to ‘safe’ Google Translate domains, most email security products would not characterize the links as suspicious. However, Darktrace/Email levies hundreds of metrics to identify whether emails belong in a recipient’s inbox. In this case Darktrace highlighted anomalies including rare subdomains, links containing unknown redirects, emails from spoofed freemail accounts and senders that had sent a relatively large number of emails within a short time frame. Furthermore, the attacker had never sent any previous emails to the organization prior to this email campaign.
On top of providing visibility, the RESPOND function of Darktrace/Email took action autonomously and instantaneously without any human confirmation required. These actions included locking links and holding malicious emails.
Figure 4- Darktrace/Email overview tab shows the Anomaly Indicators section as well as the History, Association, and Validation information of this sender.
Figure 5 - The Darktrace RESPOND/Email model tab displays all models that triggered on the email and the associated actions. The most severe delivery action supersedes the others, so here the email was held.
Concluding Thoughts
Threat actors are continuously updating the way they deliver malicious payloads within emails. While this particular email campaign utilized Google Translate domains to hide malicious links, subsequent attacks may well be seen leveraging other legitimate domains. Companies are only as strong as their weakest link; a single compromised internal email account can be used to send phishing emails to internal recipients, collect sensitive company information, inject malware onto the device, and more. Security tools must evolve to focus on anomalies within the email, rather than relying on rules or signatures of previously seen attacks. Furthermore, email tools must be able to autonomously respond as soon as the malicious emails enter the company’s environment. Only with these precautions will the risks associated with malicious emails be mitigated.
Thanks to Steven Haworth and Steven Sosa for their contributions.
Appendices
Relevant Darktrace Model Detections
· Association / Anomalous Association
· Association / New Sender
· Association / Unknown Sender
· Association / Unlikely Recipient Association
· High Antigena Anomaly [part of the RESPOND functionality]
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Darktrace / EMAIL Expands Behavioral Defense Across Email and Collaboration Workflows
New capabilities help employees understand suspicious content, give administrators more control over sensitive data, and show security teams where risky workflows sit across the organization.
AI Agents: Securing the Path from Intent to Action
The UK’s National Cyber Security Centre (NCSC) recently published guidance on managing the cyber risk of agentic AI. While the document is framed as interim advice as more formal guidance is developed, the framing reflects the current state of the industry: organizations are already deploying agents into production environments while standards, controls, and operating models for autonomous systems remain unsettled. Governance is evolving alongside adoption rather than preceding it, a reality which underscores the importance of robust controls.
The NCSC’s guidance recommends aligning controls to an agent's level of autonomy, assigning distinct identities, limiting permissions, constraining access to systems and data, monitoring activity, maintaining human oversight, and preserving the ability to intervene when necessary. Most of these recommendations will sound familiar to security teams. The challenge is not the novelty of the controls. It is the type of system those controls now need to govern.
The shift from model security to agent security
For several years, AI security discussions have focused heavily on models. Can a model be manipulated? Jailbroken? Trusted? Can it expose information it should not? Those questions remain important, but they capture only part of the problem. A model generating text is one thing. A system connected to identities, applications, tools, workflows, and business data is another.
The difference becomes clearer when comparing a chatbot that answers questions with an agent that can retrieve customer records, update tickets, invoke tools, trigger workflows, and interact with external systems. The underlying model may be identical. Its access is not. The security question begins to shift from what the model knows to what the system can do.
The same theme appears in the Five Eyes statement released earlier this year, describing AI as a force multiplier that is accelerating both offensive and defensive cyber operations. The NCSC guidance explores what that reality looks like when autonomous systems begin operating inside enterprise environments.
Securing AI agents in operation
The NCSC spends relatively little time debating model behavior and considerably more time discussing identity, permissions, monitoring, oversight, containment, and response. Agents are treated as participants within an environment rather than isolated pieces of technology.
That's broadly consistent with how we think about the problem at Darktrace.
An agent should not be treated as an extension of a user account. It develops its own behavioral patterns. It accesses systems, interacts with data, invokes tools, and moves across workflows in ways that can be observed independently. Understanding what an agent is permitted to do matters. Understanding how it actually behaves once deployed, and whether that behavior aligns with business intent, matters just as much.
Identity provides an obvious example. The NCSC recommends assigning distinct identities to agents rather than allowing them to disappear into surrounding human or service accounts. Most importantly, assigning agents distinct identities enables independent behavioral monitoring.
Development assumptions vs. real-world behavior
The same principle extends to monitoring. NCSC guidance places agent activity within normal security operations rather than treating it as a separate AI governance function. Many of the controls described are put in place before an agent begins operating. Sandboxing, credential design, approval workflows and human oversight all reflect judgments about how the system is expected to behave and what risks it is likely to create.
Actual use may challenge those assumptions. Access patterns change. Workflows expand. Systems begin interacting with resources they have never touched before. Processes that appeared reasonable during design behave differently in production. Human oversight requirements may turn out to be either excessive or inadequate once the system is operating at scale and operating within the context of unique business processes.
The Five Eyes statement points to a similar issue: organizations need confidence that controls continue to work as intended once systems are exposed to real users, data, tools and operational pressures. Often, the question is not whether an agent is technically allowed to perform an action, but whether its behavior remains consistent with the role it was intended to play.
Monitoring and governance of AI agents go hand-in-hand
This problem is exactly why monitoring and governance should be treated as part of the same process. Governance sets the initial parameters for deployment, while monitoring provides evidence about whether those parameters remain appropriate. That evidence should, in turn, inform changes to permissions, controls and oversight.
This matters increasingly as autonomous systems are integrated into business processes. The relevant risk is shaped not only by the model or agent itself, but by what it can access, what actions it can take, and how its behavior changes in practice.
Developing continuous oversight of AI agent behavior
The implication is clear: governance cannot end at deployment. Organizations need a way to understand how agents behave after deployment, test whether controls remain appropriate, and adjust them as conditions change. That requires visibility not just into technical activity, but into whether that activity makes sense in the context of the business process the agent is intended to support.
This is where business-centric behavioral security can become critical. Risk does not emerge from the model itself: it emerges from the actions an autonomous system takes within the enterprise and the downstream consequences of those actions.
An agent can operate exactly as intended and still create risk if it accesses sensitive information in an unexpected context, exercises permissions in ways that create unintended exposure, or influences business processes in ways that were not anticipated during design and review.
Traditional governance vs. behavioral analytics
Traditional governance frameworks provide assurance at a point in time. Behavioral security can provide ongoing visibility into how autonomous systems interact with the organization they are meant to serve. Rather than focusing exclusively on model performance or policy compliance, organizations need to understand whether an agent's behavior aligns with business intent, operational expectations, and acceptable risk tolerances as conditions change.
As enterprises move from isolated AI deployments to interconnected ecosystems of agents, visibility into behavior becomes as important as visibility into code. Governance determines what an autonomous system is permitted to do. Behavioral analytics helps determine what it is doing, what business outcomes it is producing, and whether those outcomes remain aligned with the organization's objectives.
When AI Becomes the Lure: A Fake Gemini Installer Delivers Vidar
Key takeaways
Darktrace observed a customer download a fake Google Gemini installer hosted on Google Colab, resulting in the execution of the Vidar information stealer.
Darktrace identified the compromise through behavioral indicators, including suspicious process activity, anomalous network communications, and indicators of credential theft, before autonomously containing the threat.
The incident highlights how threat actors are increasingly exploiting trusted platforms and a growing interest in AI tools to distribute malware through seemingly legitimate software acquisition workflows.
The Growing Abuse of Generative AI
As organizations are increasingly adopting generative AI tools into their daily workflows, attackers are adapting their distribution methods accordingly too. As part of their day-to-day work, users are now searching for AI assistants, programming tools, browser extensions, desktop applications, and productivity integrations.
Recent reports have highlighted campaigns that use fake AI software and AI-related installers to distribute malware and steal credentials [1]. Researchers have documented campaigns that exploit fake AI-themed websites and services to distribute information stealers and backdoors [2]. Security researchers have also observed attackers disguising malware as legitimate installers for AI software to increase the likelihood of victim interaction and execution [3].
In July 2026, Darktrace observed one such case within a customer environment in the Europe, Middle East and Africa (EMEA) region, where attackers used a fake generative AI installer to deliver the prolific information stealer Vidar. This incident highlights how threat actors are exploiting interest in AI services to distribute established malware using increasingly convincing social engineering techniques.
How a Fake Gemini Installer Delivered Vidar
Initial Access: From Search Result to Malware Download
Unlike many malware campaigns that begin with a phishing email, this activity appears to have originated from a user searching for and downloading software.
Darktrace first observed unusual activity on the customer network after a suspicious executable file was launched from a user’s Download folder. Further investigation revealed that the file purported to be a Google Gemini installer and was named “Download_Google_Gemini_For_Windows.exe”.
During the initial analysis, it was noted that the top search result for the suspicious filename associated pointed to a file hosted on Google Colab, a cloud-based Jupyter notebook platform, commonly used by developers, researchers, and data scientists to run code and machine learning workloads through a web browser. By leveraging another trusted Google platform, the attacker increased the likelihood that users would perceive the download as legitimate, making the lure more convincing to those searching for Gemini-related software.
Figure 1: The Google Colab page containing a download prompt for the fake Google Gemini installer.
Further investigation of the Google Colab page revealed that the download prompt redirected users to a secondary site, hxxps://micronsoftwares[.]com, which posed as a "Windows Software Hub" download page and offered the fake Gemini installer for download.
Figure 2: The secondary website posing as a "Windows Software Hub" download page, which likely hosted the fake Gemini installer.
While the investigation did not uncover any HTTP or file-download telemetry data that conclusively identified the download source, SSL communication sessions with Google Colab were detected immediately before the suspicious file was executed. The timing of these connections suggests that the user interacted with the Colab resource before being redirected to the secondary site from which the executable was downloaded.
The user was not simply tricked into opening an email attachment; instead, the attacker embedded malicious content into a process many users would consider entirely legitimate: searching for and downloading software associated with a trusted platform.
Weaponizing Trusted Platforms
At the time of review (July 15, 2026), Darktrace's Threat Research team confirmed that the Google Colab page was still active and prompting users to download a ZIP archive containing the binary file.
The archive also appeared to contain a README file instructing users to run the binary file with administrator privileges and add it to their antivirus software’s exception lists. These instructions suggest that the campaign relied heavily on social engineering, convincing users to take actions that would facilitate malware execution and potentially bypass security checks.
The use of a legitimate platform also complicates the user’s decision-making. Downloads associated with a trusted service are often perceived as less suspicious than those hosted on unfamiliar domains. When combined with the branding of a widely used AI tool, the lure becomes even more convincing.
Malware Analysis
Darktrace’s Threat Research team identified the executable file as the information-stealing malware Vidar. Analysis revealed that the binary file was a newer Go-compiled variant that communicated with Telegram-based infrastructure. Darktrace’s researchers also identified dtm[.]kijangturbo88[.]top as a command-and-control (C2) endpoint associated with the activity. While the malware itself was not novel, the lure and delivery mechanism was.
Figure 3: Darktrace’s detection of the unusual outbound connection associated with the fake Gemini installer.
Shortly after execution, the process established communications with the external IP address 91.98.98[.]86 via port 443, directly linking the executable to suspicious network activity observed on the device. Subsequent open-source intelligence (OSINT) analysis of the revealed multiple malicious associations [5].
Additional Darktrace detections included unusual SSL activity from the affected device. Analysis of related SSL telemetry identified 91.98.111[.]49 as additional infrastructure associated with the activity [6].
Subsequent alerts from the customer's Microsoft Defender for Endpoint integration later confirmed activity consistent with the theft of browser credentials and other sensitive data from the affected endpoint.
Taken together, these detections provided a clear picture of the attack, from the execution of a suspicious file and unusual network connections to indicators of C2 activity and credential theft.
Figure 4: Darktrace’s detection of anomalous activity following the execution of the fake Gemini installer, seen in the Model Alert Event Log.
Darktrace's Autonomous Response
Following the detection, Darktrace’s Autonomous Response took immediate containment action, including blocking communication with suspicious external infrastructure, including 91.98.98[.]86, and quarantining the compromised device.
Despite the apparent legitimacy of the activity, with the installer hosted on a trusted platform and resembling a routine software download, Darktrace was able to detect and contain the attack because the device's behavior deviated from its normal pattern.
Figure 5: Automated containment actions implemented by Darktrace's Autonomous Response following the detection of activity associated with the fake Gemini installer.
Conclusion
This investigation highlights how threat actors continue to adapt established malware delivery techniques to emerging technology trends. While the malware itself was not new, the distribution method was. By disguising Vidar as a Google Gemini installer and hosting the malicious content on a trusted platform, the attack aligned its lure with a growing behavioral trend: users actively searching for AI tools and services as part of their day-to-day work.
Although fake installers are not a new phenomenon, the rapid rise of generative AI has created new opportunities for threat actors. Rather than relying solely on traditional delivery methods, attackers can now target users who are actively searching for AI applications. As AI adoption continues to accelerate across enterprise environments, organizations should remain alert to campaigns that exploit this interest through fake applications, malicious websites, manipulated search results, the misuse of trusted platforms, and AI-themed social engineering.
Credit to Rushanth Ramanathan (Cyber Analyst) Joanna Ng (Detection Engineer)
Edited by Ryan Traill (Content Manager)
Appendices
Darktrace Model Detections
Security Integration / C2 Activity and Integration Detection
Endpoint / New Suspicious Executable Launched
Endpoint / Process Connection / Unusual Connection from New Process
.jpg)
