Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
Fake GitHub repos impersonate software firms to distribute Rapuncel infostealer and an EDR killer.
A malware campaign is using SEO-optimized GitHub repositories to impersonate legitimate software companies, including LastPass, to distribute a new information stealer named Rapuncel. The campaign also delivers a kernel driver, disguised as an NVIDIA component, capable of disabling 145 antivirus and EDR products by exploiting kernel-mode access to terminate processes. The Rapuncel infostealer then collects credentials from browsers, cryptocurrency wallets, and system files, uploading the data to a remote server.
AI summary of the linked source. Not reviewed by an editor. How this works
Run LastPass?
Get an email when a new story names LastPass, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers created SEO-optimized GitHub repositories impersonating trusted brands like LastPass to trick users into downloading malicious software, demonstrating how supply chain trust can be weaponized through legitimate platforms. The campaign bundled a kernel-mode driver disguised as an NVIDIA component capable of disabling 145 antivirus and EDR products, effectively blinding defenses before deploying the Rapuncel infostealer. This highlights the critical danger of downloading software from unverified sources, even when they appear on reputable platforms like GitHub. The combination of credential harvesting, crypto wallet theft, and EDR evasion makes this a high-impact, multi-stage threat that exploits both human trust and technical blind spots.
What helps against this
How we list vendors
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 2.26.126.50
- malware — Rapuncel
- malware — Alinubx.sys
- malware — BoryptGrab
- malware — Cruciferra PUROSANGUE