Rapuncel Infostealer Campaign Targets Users via Fake LastPass GitHub Repositories

• •Rapuncel infostealer impersonates LastPass to harvest credentials.
• •The malware uses a Microsoft-signed driver to disable 145 security tools.
• •Victims are lured through fake GitHub repositories claiming to offer legitimate software.

A malware campaign named Rapuncel is impersonating LastPass and other software brands to steal user credentials. Discovered by LastPass and Delphos Labs, the campaign utilizes fake GitHub repositories to lure victims into downloading malicious software. The attack begins with users searching for LastPass Authenticator, leading them to fraudulent pages that claim to host legitimate downloads. The malware, which includes a Microsoft-signed kernel driver named Alinubx.sys, can terminate 145 antivirus and EDR processes, effectively disabling security defenses. Once security tools are disabled, Rapuncel collects sensitive information such as browser passwords, cryptocurrency wallets, and messaging app credentials. The driver is disguised as an NVIDIA component to evade detection. This campaign has been active since at least August 13, 2026, and is still ongoing as of September 19, 2026.