[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f692GPnTBbUjwK1zuvx8ukkNRdZKKhWhhf7CNg7MKYTA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"00d11fca-705f-407f-971f-1906a8d3c08f","fake-lastpass-github-repos-spread-rapuncel-infostealer-via-seo-poisoning","4f0e86ae-2425-422d-b821-910f8eedb764","Fake LastPass GitHub Repos Spread Rapuncel Infostealer via SEO Poisoning","Attackers created SEO-optimized GitHub repositories impersonating trusted brands like LastPass to trick users into downloading malicious software, demonstrating how supply chain trust can be weaponized through legitimate platforms. The campaign bundled a kernel-mode driver disguised as an NVIDIA component capable of disabling 145 antivirus and EDR products, effectively blinding defenses before deploying the Rapuncel infostealer. This highlights the critical danger of downloading software from unverified sources, even when they appear on reputable platforms like GitHub. The combination of credential harvesting, crypto wallet theft, and EDR evasion makes this a high-impact, multi-stage threat that exploits both human trust and technical blind spots.","**Immediate actions:**\n- Always verify software downloads by navigating directly to the official vendor website rather than relying on search engine results or third-party repositories.\n- Cross-check GitHub repository authenticity by confirming the publisher's verified identity, star history, commit history, and official links before downloading any release.\n- Audit systems for unauthorized kernel drivers, particularly those masquerading as legitimate hardware vendor components (e.g., NVIDIA).\n\n**Long-term improvements:**\n- Implement application allowlisting policies to prevent execution of unsigned or unverified binaries and kernel drivers.\n- Establish a software supply chain vetting process that requires verification of publisher identity and code signing for all third-party tools.\n- Train staff regularly on SEO poisoning and typosquatting tactics so they can recognize and avoid malicious impersonation campaigns.\n\n**Detection measures:**\n- Deploy kernel integrity monitoring and driver signature enforcement (e.g., Windows HVCI\u002FSecure Boot) to detect and block unauthorized kernel-mode components.\n- Monitor endpoint telemetry for abnormal process terminations targeting AV or EDR agents, which may indicate driver-assisted tampering.\n- Enable data loss prevention (DLP) controls and egress filtering to detect unusual outbound transfers of credential stores or browser data.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-161: Supply Chain Risk Management","NIST SI-3: Malicious Code Protection","NIST SA-12: Supply Chain Protection","NIST PR.AT-1: Security Awareness Training","MITRE ATT&CK T1553.006: Subvert Trust Controls – Code Signing","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","GDPR Article 32: Security of Processing (credential data exposure)",{},"published","2026-09-18T16:21:02.192523+00:00","2026-09-18T16:21:01.897+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer\u002F","fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer-a8f08a","Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":56,"name":57,"problem":58},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":60,"name":61,"problem":62},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]