Typosquatted Google Antigravity Installer Delivers Credential‑Stealing PowerShell Payload
What Happened — Attackers registered the look‑alike domain google‑antigravity.com and offered a repackaged copy of Google’s Antigravity installer. The malicious MSI adds a single custom‑action that drops two PowerShell scripts, which harvest user credentials, session tokens, and system data before silently exfiltrating them.
Why It Matters for TPRM —
- Third‑party developer tools can become a covert supply‑chain vector, exposing any organization that allows employees to download utilities from the web.
- Compromised accounts can be leveraged to access corporate SaaS environments, cloud resources, and internal code repositories.
- The attack requires no user interaction beyond a standard install, making it difficult to detect with traditional endpoint AV alone.
Who Is Affected — Technology & SaaS firms, development teams, and any organization that permits the download of Google developer tools (e.g., Antigravity) on employee workstations.
Recommended Actions —
- Block the typosquatted domain
google‑antigravity.comat DNS and web proxy layers. - Enforce strict allow‑list policies for software installers; require hash verification against vendor‑published signatures.
- Deploy endpoint detection that monitors MSI custom‑action tables and unexpected PowerShell execution during installs.
- Conduct credential rotation for accounts that may have been exposed and enable MFA where possible.
Technical Notes — The malicious MSI injects a custom‑action named wefasgsdfg that runs a PowerShell script (scr5020.ps1, pss5032.ps1) from the user’s temp folder. The scripts harvest stored browser cookies, OAuth tokens, and Windows credential manager entries, then POST the data to an attacker‑controlled C2. No visible UI changes occur; the legitimate Antigravity app functions normally. Source: Malwarebytes Labs