INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Fake LastPass GitHub Repos Pushed New Infostealer 'Rapuncel' Stealer

| 2026-09-18 15:55 LOW HIGH DATA BREACH MALWARE & BOTNETS PHISHING & SOCIAL ENGINEERING
JSON
Executive Summary
AI-generated
Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools Pierluigi Paganini September 23, 2026 Attackers spoofed LastPass on GitHub, used a Microsoft-signed driver to disable 145 security products, then deployed an infostealer. Someone impersonated LastPass on GitHub, got users to download a fake authenticator, and ended up killing 145 different antivirus and EDR products using a driver that Microsoft itself had signed. That last part is the one worth sitting with. LastPass’s Threat Intelligence, Mitigation, and Escalation team spotted the fake GitHub organization on August 13, 2026.
Technical Mitigations AI-generated
• Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • User Training (ATT&CK mitigation for Impersonation): Train users to be aware of impersonation tricks and how to counter them, for example confirming incoming requests through an independent platform like a phone call or in- • Threat Intelligence Program (ATT&CK mitigation for Impersonation): Threat intelligence helps defenders and users be aware of and defend against common lures and active campaigns that have been used for impersonation. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 2 IoCs Create Free Account
cc•••••.sys
al•••••.sys
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
CN
technologytechnology
Incident Timeline
‎August 13
Threat actors used a fake LastPass authenticator GitHub repository to push a new Rapuncel infostealer, targeting users with opportunistic brand spoofing.
tactic Spoofing
Discovered on August 13, the fake LastPass lure represents opportunistic brand spoofing — with no internal LastPass systems compromised — and forms part of a campaign active for several months.
‎August 13, 2026
Threat actors created a fake GitHub organization to push a new Rapuncel infostealer, which was discovered by LastPass's Threat Intelligence team on August 13, 2026.
industry Technology
General Document Context
attribution LastPass’s Threat Intelligence, Mitigation
LastPass’s Threat Intelligence, Mitigation, and Escalation team spotted the fake GitHub organization on August 13, 2026.
‎August 19
Threat actors pushed a new Rapuncel infostealer to GitHub repositories, which was flagged by Delphos on August 19.
‎September 10
Threat actors used a JavaScript redirect to target users, as evidenced by the server's continued operation and content changes between August 27 and September 10.
tactic T1059.007 - JavaScript
The server was still active and serving a JavaScript redirect as of September 10, but “its content had changed between August 27 and September 10, confirming active ongoing maintenance,” LastPass notes.
‎between August 27 and September 10
Threat actors maintained a campaign involving a fake LastPass Authenticator GitHub repository that pushed an infostealer, specifically Rapuncel, between August 27 and September 10.
tactic T1059.007 - JavaScript
The server was still active and serving a JavaScript redirect as of September 10, but “its content had changed between August 27 and September 10, confirming active ongoing maintenance,” LastPass notes.
‎2026/09/18
Threat actors impersonated LastPass on GitHub, distributed a fake authenticator installer that loaded a companion DLL containing the attacker's code, and ultimately delivered an infostealer malware called Rapuncel.
organisation GitHub
A fake LastPass Authenticator distributed via GitHub has led to the discovery of a broad impersonation campaign delivering infostealer malware, LastPass reports.
organisation LastPass
A fake LastPass Authenticator distributed via GitHub has led to the discovery of a broad impersonation campaign delivering infostealer malware, LastPass reports.
Someone impersonated LastPass on GitHub, got users to download a fake authenticator, and ended up killing 145 different antivirus and EDR products using a driver that Microsoft itself had signed.
organisation EDR
Someone impersonated LastPass on GitHub, got users to download a fake authenticator, and ended up killing 145 different antivirus and EDR products using a driver that Microsoft itself had signed.
The DLL was likely produced using the Cruciferra package called PUROSANGUE, which was previously used to create other side-loaded DLLs that contained EDR/AV-killing code.
organisation Leaking Secrets and Erasing Refusals
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw Related: AI Agents Can Retrain Own Models Mid-Task, Leaking Secrets and Erasing Refusals
infrastructure Macos
Another page was offering a fake macOS LastPass application.
infrastructure Windows
The Rapuncel malware attempts to achieve System privileges via built-in Windows features, and installs a kernel driver posing as an NVIDIA graphics component that was designed to terminate 145 antivirus and endpoint security products.
Once the security tools are shut down, the malware starts looking for saved passwords in 25 browsers, the cryptocurrency files of 30 wallet applications, Discord tokens, Steam tokens, Telegram data, the Windows credential store, and all documents containing credential and wallet keywords.
“The malware installs itself as a Windows service that starts automatically every time the computer boots.
“The payload it delivered survived controls that were built to stop exactly this, with a Microsoft Windows Hardware Compatibility Publisher chain signature and a clean VirusTotal score.
The driver had a valid Microsoft Windows Hardware Compatibility Publisher signature.
Passwords from more than 25 browsers, wallet files from over 30 crypto apps, Discord tokens, Steam sessions, Telegram data, anything in Windows Credential Manager, screenshots of every connected monitor.
organisation Rapuncel
The Rapuncel malware attempts to achieve System privileges via built-in Windows features, and installs a kernel driver posing as an NVIDIA graphics component that was designed to terminate 145 antivirus and endpoint security products.
LastPass is internally tracking the infostealer as Rapuncel.”
organisation Discord
Once the security tools are shut down, the malware starts looking for saved passwords in 25 browsers, the cryptocurrency files of 30 wallet applications, Discord tokens, Steam tokens, Telegram data, the Windows credential store, and all documents containing credential and wallet keywords.
Passwords from more than 25 browsers, wallet files from over 30 crypto apps, Discord tokens, Steam sessions, Telegram data, anything in Windows Credential Manager, screenshots of every connected monitor.
organisation Telegram
Once the security tools are shut down, the malware starts looking for saved passwords in 25 browsers, the cryptocurrency files of 30 wallet applications, Discord tokens, Steam tokens, Telegram data, the Windows credential store, and all documents containing credential and wallet keywords.
Passwords from more than 25 browsers, wallet files from over 30 crypto apps, Discord tokens, Steam sessions, Telegram data, anything in Windows Credential Manager, screenshots of every connected monitor.
organisation Microsoft Windows
“The payload it delivered survived controls that were built to stop exactly this, with a Microsoft Windows Hardware Compatibility Publisher chain signature and a clean VirusTotal score.
organisation VirusTotal
“The payload it delivered survived controls that were built to stop exactly this, with a Microsoft Windows Hardware Compatibility Publisher chain signature and a clean VirusTotal score.
organisation Microsoft
As part of the campaign, the attackers impersonated at least 40 organizations to push a Microsoft-attested kernel driver designed to terminate 145 security tools and open the door to information-stealing malware called Rapuncel .
victims 40 organizations
As part of the campaign, the attackers impersonated at least 40 organizations to push a Microsoft-attested kernel driver designed to terminate 145 security tools and open the door to information-stealing malware called Rapuncel .
infrastructure Android
Related: RatHat Android Trojan Uses AI for Automation Related: Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems Related:
organisation Stealer
Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer.
organisation Cloudflare
The attackers used a hidden routing chain relying on multiple GitHub pages and a Cloudflare-fronted server to direct victims to the final destination, which could be changed by the operator dynamically.
A separate server behind Cloudflare then chose where to send the final malware.
organisation GitHub Pages
When victims clicked the download button, they were sent through two other GitHub Pages accounts that looked like broken 404 pages but secretly used JavaScript to redirect them to the next step.
organisation DLL
When executed, the installer, a renamed version of Microsoft’s own debugging tool, would load a companion DLL containing the attacker’s code.
It automatically loaded a malicious DLL placed in the same folder.
organisation Cruciferra
The investigation into the campaign, performed in collaboration with Delphos, revealed a connection with Cruciferra, a crypter service recently detailed by Proofpoint, through the malicious DLL loaded during the infection chain.
organisation Trend Micro’s
“Delphos compared the Rapuncel stealer payload directly against Trend Micro’s documented BoryptGrab samples.
organisation BoryptGrab
“Delphos compared the Rapuncel stealer payload directly against Trend Micro’s documented BoryptGrab samples.
organisation VirusTotal Approved
The download page also displayed fake trust badges, including “VirusTotal Approved.”
organisation MB
Delphos has seen this exact size-padding move before in an unrelated 55MB stealer sample, so it’s not new, it’s just still effective because scanners haven’t closed that gap.
organisation CcProtect.sys
Delphos traced it back to CcProtect.sys, a known Chinese disk-encryption driver already catalogued on LOLDrivers with public proof-of-concept killer code freely available on GitHub.
organisation Alinubx.sys
The attackers just renamed the file to Alinubx.sys, and that single change was enough to dodge every hash-based detection built around the original name.
organisation Chrome and Edge
For Chrome and Edge specifically, the malware injected code directly into the browser process to call the browser’s own decryption service from the inside, defeating Google’s 2024 app-bound encryption by simply asking nicely from a trusted position.
organisation Google’s
For Chrome and Edge specifically, the malware injected code directly into the browser process to call the browser’s own decryption service from the inside, defeating Google’s 2024 app-bound encryption by simply asking nicely from a trusted position.
organisation MSRC
MSRC responded that the driver behavior doesn’t meet its definition of a security vulnerability, since it’s not a Microsoft-owned component, and redirected the report to the separate blocklist submission channel instead.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, LastPass)
‎September 23, 2026
Attackers spoofed LastPass on GitHub, used a Microsoft-signed driver to disable 145 security products, then deployed an infostealer.
industry Technology
General Document Context
organisation GitHub
Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools Pierluigi Paganini September 23, 2026 Attackers spoofed LastPass on GitHub, used a Microsoft-signed driver to disable 145 security products, then deployed an infostealer.
general_metric 145 antivirus
Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools Pierluigi Paganini September 23, 2026 Attackers spoofed LastPass on GitHub, used a Microsoft-signed driver to disable 145 security products, then deployed an infostealer.
organisation Microsoft
Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools Pierluigi Paganini September 23, 2026 Attackers spoofed LastPass on GitHub, used a Microsoft-signed driver to disable 145 security products, then deployed an infostealer.
Tactical Metrics
Metrics
infrastructure
‎Macos
Affected Product
Another page was offering a fake macOS LastPass application.
Metrics
infrastructure
‎Windows
Affected Product
The Rapuncel malware attempts to achieve System privileges via built-in Windows features, and installs a kernel driver posing as an NVIDIA graphics component that was designed to terminate 145 antivirus and endpoint security products.
Once the security tools are shut down, the malware starts looking for saved passwords in 25 browsers, the cryptocurrency files of 30 wallet applications, Discord tokens, Steam tokens, Telegram data, the Windows credential store, and all documents containing credential and wallet keywords.
“The malware installs itself as a Windows service that starts automatically every time the computer boots.
“The payload it delivered survived controls that were built to stop exactly this, with a Microsoft Windows Hardware Compatibility Publisher chain signature and a clean VirusTotal score.
The driver had a valid Microsoft Windows Hardware Compatibility Publisher signature.
Passwords from more than 25 browsers, wallet files from over 30 crypto apps, Discord tokens, Steam sessions, Telegram data, anything in Windows Credential Manager, screenshots of every connected monitor.
Metrics
infrastructure
‎Android
Affected Product
Related: RatHat Android Trojan Uses AI for Automation Related: Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems Related:
Metrics
victims
40
Organizations
As part of the campaign, the attackers impersonated at least 40 organizations to push a Microsoft-attested kernel driver designed to terminate 145 security tools and open the door to information-stealing malware called Rapuncel .
Intelligence Sources
SecurityWeek 2026-09-21
Security Affairs 2026-09-23
AlienVault OTX 2026-09-18