Published on September 18, 2026
Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
Severity
Medium
Detail
Security researchers have identified an ongoing malware campaign using SEO-optimized fake GitHub repositories to impersonate LastPass and at least 39 other software companies. The campaign delivers a previously undocumented information-stealing malware named Rapuncel along with a Microsoft-signed kernel driver capable of terminating security software.
The campaign targets users searching for legitimate software downloads, directing them to fraudulent GitHub repositories and download pages. The attackers use trusted GitHub infrastructure, fake software installers, and oversized ZIP archives to make the downloads appear legitimate and evade automated security scanning.
How?
The attack begins when a victim searches for software such as LastPass Authenticator and encounters a fraudulent GitHub repository designed to resemble the legitimate vendor’s page. Clicking the download button redirects the victim through multiple pages before delivering a malicious ZIP archive.
The ZIP files can be inflated to more than 100 MB, allowing the attackers to evade security scanners that impose file-size limitations. The archive contains a fake software installer and supporting files.
The installer is actually a renamed copy of Microsoft’s legitimate Visual Studio CoreCLR Debugger (vsdbg.exe). When executed, it sideloads a malicious vsdbg.dll, which subsequently installs the Rapuncel infostealer and the Alinubx.sys kernel driver.
The Alinubx.sys driver is disguised as an NVIDIA component named nvfsflt64.sys and registers itself as the NvFsFilter service. It contains a hardcoded list of 145 antivirus and EDR processes that it attempts to terminate from kernel mode. The driver is signed through Microsoft’s Windows Hardware Compatibility Publisher chain and was not included in Microsoft’s vulnerable driver blocklist at the time of the investigation.
After security software is disabled, Rapuncel collects sensitive information from the compromised system, including credentials from 25 web browsers, data from 30 cryptocurrency wallets, Discord, Steam and Telegram session credentials, Windows Credential Manager data, documents containing terms such as “password,” “seed,” “wallet,” or “recovery,” screenshots, and detailed system information.
Rapuncel can also bypass browser protections such as Google’s app-bound encryption by injecting a helper DLL into Chrome, Edge, and related browsers and using the browser’s own Elevation Service to decrypt protected data. The collected information is compressed and sent to attacker-controlled infrastructure.
The malware establishes persistence through a Windows service, allowing it to restart after system reboots and attempt to terminate security products again before continuing its information-stealing activity. Researchers assessed with moderate confidence that Rapuncel is related to the BoryptGrab malware family.
Recommendation
Organizations should implement a layered security approach to reduce the risk of Rapuncel and similar infostealer infections:
- Download software only from official vendor websites and trusted application stores.
- Avoid downloading software from suspicious or unofficial GitHub repositories.
- Monitor for suspicious GitHub downloads, oversized ZIP archives, and unexpected software installers.
- Monitor for unauthorized driver installations, particularly suspicious kernel drivers and new Windows services.
- Use EDR to detect attempts to terminate security products and suspicious access to browser credentials.
- Review endpoints for unauthorized access to browser credentials, cryptocurrency wallets, Windows Credential Manager, and sensitive documents.
- Monitor for suspicious outbound connections associated with information-stealing activity.
Conclusion
The Rapuncel campaign demonstrates how threat actors are combining SEO manipulation, fake GitHub repositories, legitimate Microsoft-signed components, and kernel-level security evasion to distribute information-stealing malware.
The use of a signed kernel driver capable of terminating 145 security products significantly increases the potential impact of an infection. Organizations should enforce trusted software sources, monitor driver and service installation, and use behavioral EDR detections to identify suspicious activity beyond traditional malware signatures.
Source