Fake Google Antigravity Installer Drops NWHStealer — Credential, Session, and Crypto Wallet Theft via Trojanized AI IDE
Fake Google Antigravity Installer Drops NWHStealer (TL-2026-0405), also tracked as Fake Antigravity Stealer Campaign, is a high-severity malware campaign, first published 2026-04-21. It has no confirmed attribution, affects Google Antigravity (AI IDE — impersonated, not vulnerable), maps to 30 MITRE ATT&CK techniques (T1005, T1012, T1027), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0405
- Threat ID
- TL-2026-0405
- Also known as
- Fake Antigravity Stealer Campaign, Antigravity Trojanized Installer, NWHStealer (Antigravity lure variant)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-04-21
- Last reviewed
- 2026-04-21
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, financial, cryptocurrency, gaming, education, consumer
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Fake Google Antigravity Installer Drops NWHStealer
Malware and tooling: NWHStealer, Custom PowerShell + .NET reflective loader
A malvertising and typosquatting campaign distributes a trojanized Google Antigravity installer from google-antigravity[.]com that launches the legitimate AI IDE while a PowerShell-staged .NET stealer (NWHStealer family) exfiltrates browser sessions, saved credentials, OAuth tokens, clipboard data, and cryptocurrency wallets to C2 opus-dsn[.]com. The installer embeds a malicious PowerShell dropper inside the MSI CustomAction table, disables AMSI and Microsoft Defender, and stages encrypted payloads from BunnyCDN (captr.b-cdn[.]net) before loading reflectively in-memory and persisting via scheduled task. The same stealer infrastructure has been observed impersonating Proton VPN, hardware utilities, and game mods, showing a broad lure-swap capability.
How Fake Google Antigravity Installer Drops NWHStealer works
Malwarebytes publicly disclosed on 2026-04-21 that threat actors are distributing a trojanized Windows installer impersonating Google Antigravity — Google's agentic AI coding IDE launched in November 2025. The campaign capitalizes on search intent around the product launch and is seeded through SEO poisoning, paid-search malvertising, and at least one typosquat domain, google-antigravity[.]com (note: the legitimate product lives at antigravity.google). Victims who download Antigravity_v1.22.2.0.exe (SHA-256 61aca585687ec21a182342a40de3eaa12d3fc0d92577456cae0df37c3ed28e99) receive a working copy of the genuine Google Antigravity application packaged alongside malicious PowerShell logic injected into the MSI CustomAction table. The legitimate UI launches to avoid user suspicion while the malicious stage runs in a hidden console.
Execution begins with a PowerShell downloader cradle that writes a randomly-prefixed script (scr5020.ps1 / pss5032.ps1) and contacts opus-dsn[.]com (resolving to 89.124.96.27). The dropper disables the Antimalware Scan Interface by writing AmsiEnable=0 to HKLM\Software\Policies\Microsoft\Windows Script\Settings, adds Microsoft Defender path exclusions for LOCALAPPDATA, and forces a gpupdate to apply the new posture. Second-stage encrypted payloads (secret.png and GGn.xml, and an encrypted blob masqueraded as MicrosoftEdgeUpdate.png) are pulled from BunnyCDN edge captr.b-cdn[.]net. Payloads are decrypted with AES-256-CBC using PBKDF2 with 10,000 iterations, yielding two .NET assemblies: one is persisted via a scheduled task (LOGON trigger, SYSTEM privileges), and the second executes only in memory to resist disk-based forensics.
The in-memory .NET assembly is an NWHStealer variant — the same family Malwarebytes tracked days earlier across fake Proton VPN pages (vpn-proton-setup[.]com, get-proton-vpn[.]com), Sidebar Diagnostics and HardwareVisualizer lookalikes on SourceForge/onworks.net, and gaming mods on GitHub (Lossless-Scaling v3.22). NWHStealer enumerates Chromium-family browsers (Chrome, Edge, Brave, Chromium, Opera, 360, K-Meleon, Chromodo) and Firefox-family browsers for Logins, Cookies, and Autofills; raids more than 25 cryptocurrency wallet folders and registry keys; scrapes Discord, Telegram, Steam, FTP clients, and Authy/2FA tokens; logs keystrokes; hijacks the clipboard (wallet-address swapping); and can spawn a hidden desktop session for hands-on-keyboard remote control. Exfiltration is AES-CBC encrypted over HTTPS to opus-dsn[.]com; a Telegram dead-drop channel (t[.]me/gerj_threuh) serves as a backup resolver for rotating C2.
The campaign is currently untethered from a named actor but aligns with the broader criminal stealer-as-a-service ecosystem that pivoted aggressively toward fake AI-tooling lures in 2026 (Cursor, Windsurf, Claude Code, and now Antigravity). Targets are indiscriminate — any Windows user searching for Antigravity — but the operational impact skews heaviest against developers and security researchers, who tend to have GitHub PATs, cloud SSO cookies, AWS/GCP credentials, npm/PyPI tokens, and VPN session cookies cached in their browsers. Post-theft, the resulting sessions support downstream supply-chain compromise of the victim's code repositories and cloud tenancies. Blocking the three observed C2/delivery hosts at egress, pinning Google Antigravity downloads to antigravity.google, enforcing AMSI via tamper protection, and rotating browser-resident developer secrets for any user exposed to the installer are the immediate defensive priorities.
MITRE ATT&CK techniques used in TL-2026-0405
Collection
T1005 Data from Local System; T1115 Clipboard Data; T1185 Browser Session Hijacking
Discovery
T1012 Query Registry; T1082 System Information Discovery; T1518 Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
stealth
T1218 System Binary Proxy Execution
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Resource Development
Affected products and versions in Fake Google Antigravity Installer Drops NWHStealer
- Google — Antigravity (AI IDE — impersonated, not vulnerable)
Vulnerable versions: N/A — brand impersonation, not a product flaw
Fixed in: N/A - Microsoft — Windows (all supported desktop SKUs)
Vulnerable versions: Windows 10 21H2+; Windows 11 22H2+; Windows Server 2019; Windows Server 2022
Fixed in: N/A — social engineering - Google — Chrome (credential/session target)
Vulnerable versions: All versions — browser data at rest is targeted
Fixed in: N/A - Microsoft — Edge (credential/session target)
Vulnerable versions: All Chromium Edge versions
Fixed in: N/A - Mozilla — Firefox (credential/session target)
Vulnerable versions: All versions
Fixed in: N/A - Brave Software — Brave Browser (credential/session target)
Vulnerable versions: All versions
Fixed in: N/A
Remediation for Fake Google Antigravity Installer Drops NWHStealer
Patches
- No vendor patch applicable — this is a social-engineering campaign targeting end users, not a software vulnerability in Google Antigravity itself
Immediate actions
- Block google-antigravity[.]com, opus-dsn[.]com, and captr.b-cdn[.]net at DNS/proxy egress
- Block outbound traffic to 89.124.96.27 at the perimeter firewall
- Hunt for SHA-256 61aca585687ec21a182342a40de3eaa12d3fc0d92577456cae0df37c3ed28e99 across endpoint telemetry and email gateways
- For any user exposed to the installer: force-rotate browser-cached developer secrets (GitHub PATs, cloud SSO, AWS/GCP/Azure tokens, npm/PyPI tokens), terminate all active browser sessions, and reset passwords for services used on the host
- Rotate cryptocurrency wallet seed phrases and move funds for any affected wallet directory
- Alert and page any endpoint where HKLM\Software\Policies\Microsoft\Windows Script\Settings\AmsiEnable was set to 0 in the last 30 days
Workarounds
- Until DNS/proxy blocks propagate, advise developers to download Google Antigravity only from antigravity.google and to verify the MSI digital signature is issued to Google LLC before execution
- Quarantine endpoints that recently executed an MSI whose CustomAction table invokes powershell.exe
- Disable Run Dialog command history collection for high-risk users to reduce clipboard stealer yield on crypto addresses
Longer-term hardening
- Enforce Microsoft Defender tamper protection and Attack Surface Reduction rule Block execution of potentially obfuscated scripts (5BEB7EFE-FD9A-4556-801D-275E5FFC04CC)
- Enforce Attack Surface Reduction rule Block Win32 API calls from Office macros and Block credential stealing from the Windows local security authority subsystem (9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2)
- Pin software downloads to vendor canonical domains via DNS allowlisting where feasible, with explicit entries for antigravity.google
- Deploy browser-extension or endpoint DLP controls that detect mass cookie/Login Data file reads outside normal browser processes
- Enable PowerShell ScriptBlock logging (4104) and Module logging org-wide; forward to SIEM with retention >=180 days
- Require named app allowlisting (WDAC or AppLocker) for MSI installer execution from non-enterprise publishers
Timeline of Fake Google Antigravity Installer Drops NWHStealer
- Google publicly launches Antigravity, its agentic AI coding IDE, at antigravity.google. Surge in search interest creates a high-intent download audience.
- First public reports surface that Google Antigravity agentic behaviors can be abused (prompt-injection research) — ecosystem attention spikes further, extending malvertising runway.
- Malwarebytes reports fake Claude Code install pages delivering infostealers — confirms an established criminal pattern of impersonating new AI developer tools.
- Malwarebytes publishes first broad analysis of NWHStealer across fake Proton VPN, hardware utilities, and game mods — establishing the stealer family later reused in the Antigravity lure.
- Earliest Antigravity-themed trojanized installer (SHA-256 61aca585…) observed by Malwarebytes telemetry; typosquat google-antigravity[.]com serving payload.
- Threadlinqs Intelligence opens TL-2026-0405 to track the campaign, generate detections, and correlate C2 infrastructure with BeaconBeagle.
- Malwarebytes publishes public analysis of fake Google Antigravity downloads; IOCs released for opus-dsn[.]com, captr.b-cdn[.]net, 89.124.96.27, and the Antigravity_v1.22.2.0.exe hash.
- As of 2026-05-29, this remains active: the NWHStealer family behind the fake Google Antigravity lure is still being distributed and evolving, with Malwarebytes reporting new Bun-runtime delivery on 2026-05-06 and the broader fake-AI-tool malvertising ecosystem (Claude/Cursor/OpenAI lures) ongoing. No takedown, arrest, or patch applies since this is brand impersonation, not a software flaw.
Sources cited for Fake Google Antigravity Installer Drops NWHStealer
- Fake Google Antigravity downloads are stealing accounts in minutes
- From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere (NWHStealer)
- Fake Claude Code install pages hit Windows and Mac users with infostealers
- Hybrid Analysis sandbox report — Antigravity.exe
- Google Antigravity Quarantined — Malwarebytes Forums detection thread
- MITRE ATT&CK T1539 Steal Web Session Cookie
- MITRE ATT&CK T1555.003 Credentials from Web Browsers
- MITRE ATT&CK T1218.007 System Binary Proxy Execution: MSIEXEC
Threats related to Fake Google Antigravity Installer Drops NWHStealer
- SnappyClient C2 Framework — New Implant Delivered via HijackLoader and ClickFix
- Fake Roblox Xeno Script Launcher Pushes Multi-Stage Java-Based Infostealer and RAT Malware (Powercat Campaign)
- 108 Malicious Chrome Extensions Share C2 Infrastructure for Session Cookie Theft and Browser Data Exfiltration
- MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop (hVNC) to Hijack Live Browser Sessions and Steal Credentials
- macOS Info-Stealer Chains Fake Password Prompt, Telegram Session Theft, and Crypto Wallet App Replacement
- MedusaHVNC — Hidden Virtual Desktop RAT with AMSI/ETW Bypass and Multi-Browser Session Hijacking
Detection coverage for TL-2026-0405
As of 2026-04-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0405 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.