CyberNew CyberNew
Ransomware & Malware BleepingComputer 4 weeks ago

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: HIGH
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel. LastPass and Delphos Labs uncovered the campaign, which they report impersonates the password manager brand and at least 39 other companies. Alongside the Rapuncel infostealer, the repositories deliver a Microsoft-signed..."

Recommended Defense & Mitigation

  • Access Review: Audit administrative roles, enforce phishing-resistant MFA, and review privilege escalations.
  • Credential Rotation: Rotate high-privilege service credentials and tokens associated with impacted services.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

LastPass

 An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel.

LastPass and Delphos Labs uncovered the campaign, which they report impersonates the password manager brand and at least 39 other companies.

Alongside the Rapuncel infostealer, the repositories deliver a Microsoft-signed kernel driver that can disable 145 antivirus and endpoint detection and response (EDR) products.

The attack chain begins when victims search for LastPass Authenticator or other popular software and follow links to fake GitHub repos.

There, clicking download buttons triggers a series of redirections before reaching payload-delivery servers, where victims receive ZIP archives with their size inflated to up to 148MB to evade security scans.

Save your seat

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →