The commands allow the malware to self-update, with the attackers being able to deliver a new version, as well as additional payloads in the form of Python scripts.

A vulnerability in Google's Gemini CLI allowed attackers to silently execute malicious commands and exfiltrate data from ...