[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpmIsRJ5jh4jaAf4AqFXyfLEHfl_K5C-ruNzG21ftGkk":3},{"article":4,"iocs":54,"watch_terms":71,"solutions":72,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"4f0e86ae-2425-422d-b821-910f8eedb764","Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer","fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer-a8f08a","An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel. [...]","A malware campaign is using SEO-optimized GitHub repositories to impersonate legitimate software companies, including LastPass, to distribute a new information stealer named Rapuncel. The campaign also delivers a kernel driver, disguised as an NVIDIA component, capable of disabling 145 antivirus and EDR products by exploiting kernel-mode access to terminate processes. The Rapuncel infostealer then collects credentials from browsers, cryptocurrency wallets, and system files, uploading the data to a remote server.","Fake GitHub repos impersonate software firms to distribute Rapuncel infostealer and an EDR killer.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F06\u002F23\u002Flastpass.jpg","2026-09-18T15:19:06+00:00","2026-09-18T16:00:37.749856+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"LastPass Authenticator","product",{"name":21,"type":22},"LastPass","vendor",{"name":24,"type":19},"GitHub",{"name":26,"type":19},"Microsoft Visual Studio CoreCLR Debugger",{"name":28,"type":19},"vsdbg.exe",{"name":30,"type":19},"nvfsflt64.sys","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62,65,68],{"type":56,"value":57,"context":58},"ip","2.26.126.50","C2 server IP address for Rapuncel infostealer",{"type":35,"value":60,"context":61},"Rapuncel","Name of the information stealer",{"type":35,"value":63,"context":64},"Alinubx.sys","Name of the kernel driver used to kill AV\u002FEDR",{"type":35,"value":66,"context":67},"BoryptGrab","Potential variant of Rapuncel infostealer",{"type":35,"value":69,"context":70},"Cruciferra PUROSANGUE","Crypter used for the Rapuncel loader",[21,18,24],{"controls":73,"vendors":158},[74,103,132],{"slug":75,"name":76,"problem":77,"products":78},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"slug":104,"name":105,"problem":106,"products":107},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":133,"name":134,"problem":135,"products":136},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[137,143,151],{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":138,"product_name":139,"url":141,"description":142},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":152,"product_name":155,"url":156,"description":157},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[159],{"slug":80,"name":81,"logo_path":82,"roles":160},[161],"affected",{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":177},"fake-lastpass-github-repos-spread-rapuncel-infostealer-via-seo-poisoning","Fake LastPass GitHub Repos Spread Rapuncel Infostealer via SEO Poisoning","Attackers created SEO-optimized GitHub repositories impersonating trusted brands like LastPass to trick users into downloading malicious software, demonstrating how supply chain trust can be weaponized through legitimate platforms. The campaign bundled a kernel-mode driver disguised as an NVIDIA component capable of disabling 145 antivirus and EDR products, effectively blinding defenses before deploying the Rapuncel infostealer. This highlights the critical danger of downloading software from unverified sources, even when they appear on reputable platforms like GitHub. The combination of credential harvesting, crypto wallet theft, and EDR evasion makes this a high-impact, multi-stage threat that exploits both human trust and technical blind spots.",[167,168,169,170,171,172,173,174,175,176],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-161: Supply Chain Risk Management","NIST SI-3: Malicious Code Protection","NIST SA-12: Supply Chain Protection","NIST PR.AT-1: Security Awareness Training","MITRE ATT&CK T1553.006: Subvert Trust Controls – Code Signing","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","GDPR Article 32: Security of Processing (credential data exposure)",{}]