Malicious LastPass Repositories Distribute Rapuncel Infostealer via GitHub

• •Fake LastPass repositories on GitHub distribute the Rapuncel infostealer.
• •Malware targets credentials from over 25 browsers and 30 crypto wallets.
• •A signed kernel driver can disable security processes, complicating detection.

A campaign impersonating LastPass has been identified, distributing the Rapuncel infostealer through fake GitHub repositories. Users searching for 'LastPass Authenticator download' are misled into downloading malicious software that masquerades as legitimate. The malware is capable of stealing sensitive information, including credentials from over 25 browsers and data from more than 30 cryptocurrency wallets. A signed kernel driver, disguised as an NVIDIA file, can terminate security processes, making detection difficult. The operation involved fraudulent organizations mimicking LastPass and other brands, using SEO tactics to appear at the top of search results. The malicious package can evade antivirus detection and is designed to maintain persistence on infected systems. LastPass and Delphos Labs have confirmed the findings and are working to mitigate the threat.