Fake LastPass GitHub Repos Spread Rapuncel Infostealer via SEO Poisoning
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers created SEO-optimized GitHub repositories impersonating trusted brands like LastPass to trick users into downloading malicious software, demonstrating how supply chain trust can be weaponized through legitimate platforms. The campaign bundled a kernel-mode driver disguised as an NVIDIA component capable of disabling 145 antivirus and EDR products, effectively blinding defenses before deploying the Rapuncel infostealer. This highlights the critical danger of downloading software from unverified sources, even when they appear on reputable platforms like GitHub. The combination of credential harvesting, crypto wallet theft, and EDR evasion makes this a high-impact, multi-stage threat that exploits both human trust and technical blind spots.
Tactical Insight
Immediate actions
- Always verify software downloads by navigating directly to the official vendor website rather than relying on search engine results or third-party repositories.
- Cross-check GitHub repository authenticity by confirming the publisher's verified identity, star history, commit history, and official links before downloading any release.
- Audit systems for unauthorized kernel drivers, particularly those masquerading as legitimate hardware vendor components (e.g., NVIDIA).
Long-term improvements
- Implement application allowlisting policies to prevent execution of unsigned or unverified binaries and kernel drivers.
- Establish a software supply chain vetting process that requires verification of publisher identity and code signing for all third-party tools.
- Train staff regularly on SEO poisoning and typosquatting tactics so they can recognize and avoid malicious impersonation campaigns.
Detection measures
- Deploy kernel integrity monitoring and driver signature enforcement (e.g., Windows HVCI/Secure Boot) to detect and block unauthorized kernel-mode components.
- Monitor endpoint telemetry for abnormal process terminations targeting AV or EDR agents, which may indicate driver-assisted tampering.
- Enable data loss prevention (DLP) controls and egress filtering to detect unusual outbound transfers of credential stores or browser data.