[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEv_ICZqkmLV0WTk8pLlYJChmHp04GYzU1nU1F9O4erk":3},{"article":4,"iocs":53,"watch_terms":63,"solutions":64,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"876c9919-0e10-41eb-a872-a69baca0c25d","Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer","fake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer-56037a","The attackers impersonate at least 40 companies and disable 145 security products to deploy infostealer malware. The post Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer appeared first on SecurityWeek.","Attackers are impersonating at least 40 companies, including LastPass, to distribute a kernel driver that disables 145 security products. This campaign, active for months, uses SEO-optimized GitHub pages and Cloudflare to lure victims into downloading a fake installer that loads the 'Rapuncel' infostealer. The malware then steals credentials from browsers, crypto wallets, and messaging apps, while also profiling the system.","Fake LastPass installers deliver kernel-level EDR killer and 'Rapuncel' stealer malware.","https:\u002F\u002Fwww.securityweek.com\u002Ffake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002Fmalware-infection.webp","2026-09-21T15:46:58+00:00","2026-09-21T16:00:54.673566+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"LastPass Authenticator","product",{"name":21,"type":19},"LastPass",{"name":23,"type":24},"Microsoft","vendor",{"name":26,"type":27},"EDR","technology",{"name":29,"type":27},"GitHub","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,60],{"type":34,"value":55,"context":56},"Rapuncel","Infostealer malware delivered via fake installers.",{"type":34,"value":58,"context":59},"BoryptGrab","Rapuncel is assessed to be a variant or sibling build of BoryptGrab.",{"type":34,"value":61,"context":62},"Cruciferra","Malicious DLL loaded during infection chain linked to Cruciferra crypter service.",[23,18,21],{"controls":65,"vendors":141},[66,86,112],{"slug":67,"name":68,"problem":69,"products":70},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[71,78],{"vendor_slug":72,"vendor_name":23,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":87,"name":88,"problem":89,"products":90},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[91,99,104],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":72,"vendor_name":23,"vendor_logo":73,"product_slug":100,"product_name":101,"url":102,"description":103},"app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"slug":113,"name":114,"problem":115,"products":116},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":158},"fake-software-installers-deploy-edr-killing-malware-and-credential-stealer","Fake Software Installers Deploy EDR-Killing Malware and Credential Stealer","Attackers are exploiting user trust in well-known brands like LastPass by creating convincing fake download pages optimized for search engine visibility, tricking users into installing malicious software. The campaign deploys a kernel-level driver capable of disabling 145 security products — including EDR solutions — effectively blinding defenses before deploying the 'Rapuncel' infostealer. This matters because once kernel-level access is achieved, traditional endpoint protections are neutralized, leaving credentials, crypto wallets, and sensitive communications fully exposed. The use of legitimate platforms like GitHub and Cloudflare adds credibility to the deception, making it harder for both users and automated filters to detect the threat.",[147,148,149,150,151,152,153,154,155,156,157],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 10 – Malware Defenses","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 CM-7 – Least Functionality","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AC-6 – Least Privilege","NIST CSF DE.CM-4 – Malicious Code Detection","MITRE ATT&CK T1553 – Subvert Trust Controls","MITRE ATT&CK T1068 – Exploitation for Privilege Escalation","MITRE ATT&CK T1555 – Credentials from Password Stores","GDPR Article 32 – Security of Processing (credential theft impact)",{}]