Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel.

LastPass and Delphos Labs uncovered the campaign, which they report impersonates the password manager brand and at least 39 other companies.

Alongside the Rapuncel infostealer, the repositories deliver a Microsoft-signed kernel driver that can disable 145 antivirus and endpoint detection and response (EDR) products.

The attack chain begins when victims search for LastPass Authenticator or other popular software and follow links to fake GitHub repos.

There, clicking download buttons triggers a series of redirections before reaching payload-delivery servers, where victims receive ZIP archives with their size inflated to up to 148MB to evade security scans.