GoKawiilFake LastPass Authenticator GitHub repos spread new Rapuncel infostealer
LastPass and Delphos Labs identified a malware campaign that uses SEO-optimized GitHub repositories impersonating LastPass and at least 39 other companies to distribute a previously unseen infostealer called Rapuncel. Victims searching for tools like LastPass Authenticator are led to fake repos where oversized ZIP files hide a renamed Microsoft debugger that sideloads the malicious payload and a Microsoft-signed kernel driver capable of killing 145 different antivirus and EDR products.
GoKawiil's interpretation of the reporting above, not reported fact.
The abuse of a legitimately signed Microsoft driver to disable security tools, including those protected by Protected Process Light, shows attackers finding ways around trusted code-signing safeguards. Because the driver isn't yet on Microsoft's blocklist, many endpoint defenses remain exposed until it's flagged, making this a serious supply-chain and detection-evasion threat.
- Attackers impersonate 40+ brands via SEO-boosted fake GitHub repos to distribute malware
- A Microsoft-signed kernel driver can disable 145 antivirus/EDR products, bypassing PPL protections
- The driver isn't yet on Microsoft's vulnerable driver blocklist, leaving many systems currently unprotected
YubiKey 5 NFC Security Key — With fake password-manager installers now delivering kernel-level malware, relying on software downloads alone is risky. A hardware security key like the YubiKey adds a physical authentication layer that stolen credentials or infostealers can't replicate, keeping your accounts safe even if malware slips through.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-18
Published there as: “Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.