Fake LastPass Downloads on GitHub Distribute Rapuncel Infostealer

• •Fake GitHub repos impersonate LastPass and 39 other companies.
• •The Rapuncel infostealer collects sensitive data from browsers and wallets.
• •A Microsoft-signed kernel driver disables antivirus protections.

A malware campaign impersonating LastPass on GitHub has been uncovered, distributing an information stealer named Rapuncel. The campaign, identified by LastPass and Delphos Labs, uses fake GitHub repositories to lure users searching for LastPass Authenticator downloads. Victims are redirected to malicious download pages where they receive ZIP files containing a disguised installer that sideloads a malicious DLL. This installer deploys a kernel driver, Alinubx.sys, which can disable 145 antivirus and EDR products. The Rapuncel infostealer collects sensitive data including browser credentials, cryptocurrency wallet information, and session tokens from various applications. The malware also bypasses app-bound encryption in Chrome and Edge. LastPass confirmed that their systems were not compromised, and the attack was first detected on August 13, 2026.