PANAMA CITY, PANAMA — April 29, 2026 – NordVPN’s Threat Intelligence research unit has uncovered multiple active malicious campaigns exploiting interest in Google Gemini. The operations target developers and tech-savvy users by impersonating the official Gemini Command-Line Interface (CLI), a tool developers use to interact with the AI directly from their computer’s terminal.
Instead of delivering the legitimate software, the campaigns distribute a reverse shell, a type of malware that forces the victim’s device to establish a connection back to the attacker’s server. Once active, this gives the attacker complete and unrestricted remote control over the compromised machine, with no further action required on their end.
“AI tools are generating huge interest right now, and attackers are moving fast to exploit that,” says Domininkas Virbickas, product director at NordVPN. “The payloads being delivered here grant full remote access to a victim’s machine, which makes this a serious threat regardless of how technically sophisticated the target is.”
From a single command to full device takeover
On macOS, the attack begins with a convincing clone of the official Google Gemini CLI web page, which instructs the user to run a command in their terminal. The command looks innocuous, but it is encoded in Base64, a simple text encoding format, specifically to obscure what it actually does.
Once decoded, the command downloads a malicious script from a remote server and immediately runs it with the highest administrative privileges available on the system. It means the attacker’s code can read, modify, or delete any file on the device, install additional malware, or use the compromised Mac as a launchpad to access corporate networks the device is connected to.
The Windows variant is equally aggressive but uses a different delivery method. A PowerShell command, disguised with variable names like $Install=’GeminiCLI’ to look like a legitimate software setup process, connects to a remote server and executes malicious code directly in the device’s memory.
Running code in memory rather than writing it to disk is a technique known as a “fileless” attack, and it is specifically designed to evade traditional antivirus software that scans files for known threats.
A fake developer package in preparation
Beyond the direct attacks, NordVPN’s researchers also identified a typosquatting operation targeting the npm ecosystem, the package registry widely used by software developers. Fake package names including gemini/cli and gemini-cli were registered or are being prepared to mimic the official google/gemini-cli package.
The strategy exploits a common habit among developers of omitting the organization prefix when searching for or installing packages. Although the fake package had not yet appeared in the npm registry at the time of analysis, its preparation signals an active and imminent threat. Once published, any developer who installs it by mistyping the package name could unknowingly execute malicious code.
How to stay safe
These campaigns illustrate how quickly threat actors adapt to cultural and technological trends to make their attacks more convincing. NordVPN’s researchers advise users to take the following precautions.
- Only download developer tools from official sources. For Google Gemini CLI, the only legitimate source is the official Google repository. Be skeptical of any website, forum post, or social media message offering early or unofficial access.
- Never run a terminal or PowerShell command you did not write yourself unless you fully understand what it does. Legitimate software installers do not ask users to copy and paste commands from a webpage.
- Developers should verify package names in full before installation, including the organization prefix. The official package is google/gemini-cli, not gemini/cli or gemini-cli.
- Use security software that includes behavioral detection, not just file-based scanning. Fileless attacks are specifically engineered to bypass traditional antivirus tools.