[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fd4whN6RgGZ_rF8U3t4o5TaViDoIdtf_BrlSkOG5r8Zw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"b5be2680-7ffa-427f-855e-ef603dffdd6a","fake-software-installers-deploy-edr-killing-malware-and-credential-stealer","876c9919-0e10-41eb-a872-a69baca0c25d","Fake Software Installers Deploy EDR-Killing Malware and Credential Stealer","Attackers are exploiting user trust in well-known brands like LastPass by creating convincing fake download pages optimized for search engine visibility, tricking users into installing malicious software. The campaign deploys a kernel-level driver capable of disabling 145 security products — including EDR solutions — effectively blinding defenses before deploying the 'Rapuncel' infostealer. This matters because once kernel-level access is achieved, traditional endpoint protections are neutralized, leaving credentials, crypto wallets, and sensitive communications fully exposed. The use of legitimate platforms like GitHub and Cloudflare adds credibility to the deception, making it harder for both users and automated filters to detect the threat.","**Immediate actions:**\n- Always download software exclusively from official vendor websites or verified app stores, never from search engine ads or third-party GitHub pages.\n- Verify the cryptographic hash or digital signature of any installer before executing it.\n- Audit and restrict which kernel-level drivers are permitted to load using application allowlisting or Windows Defender Application Control (WDAC).\n\n**Long-term improvements:**\n- Enforce a software procurement policy that requires IT-approved sources for all installations, removing local admin rights from standard users.\n- Deploy a vulnerability management program that tracks and alerts on unauthorized or newly installed kernel drivers across endpoints.\n- Implement DNS filtering and web proxy controls to block SEO-poisoned and newly registered malicious domains.\n\n**Detection measures:**\n- Monitor for suspicious driver load events (Event ID 7045) and alert on any driver not present in an approved baseline inventory.\n- Enable tamper protection on all EDR\u002FAV solutions to prevent kernel-level disabling attacks.\n- Establish behavioral monitoring rules to detect mass credential access patterns across browsers, crypto wallets, and messaging applications.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 10 – Malware Defenses","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 CM-7 – Least Functionality","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AC-6 – Least Privilege","NIST CSF DE.CM-4 – Malicious Code Detection","MITRE ATT&CK T1553 – Subvert Trust Controls","MITRE ATT&CK T1068 – Exploitation for Privilege Escalation","MITRE ATT&CK T1555 – Credentials from Password Stores","GDPR Article 32 – Security of Processing (credential theft impact)",{},"published","2026-09-21T16:20:23.894391+00:00","2026-09-21T16:20:23.576+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.securityweek.com\u002Ffake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer\u002F","fake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer-56037a","Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":45,"name":46,"slug":47,"description":48,"color":49},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[52,56,60],{"slug":53,"name":54,"problem":55},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":57,"name":58,"problem":59},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":61,"name":62,"problem":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]