MalwarePublished 18 Sep 2026

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

Source Bleeping Computer

malware

Description

A malware campaign uses fake GitHub repositories impersonating LastPass Authenticator and other software brands to distribute the Rapuncel infostealer. The campaign delivers a Microsoft-signed kernel driver that disables 145 antivirus and EDR products, allowing the infostealer to harvest credentials, cryptocurrency wallet data, session tokens, and sensitive documents. The driver bypasses common protections by operating in kernel mode and is currently not blocked by Microsoft. The malware persists via a Windows service, re-killing security tools on reboot.

Impact

The campaign enables attackers to disable a wide range of antivirus and endpoint detection and response products, effectively neutralizing security defenses on infected systems. This allows the Rapuncel infostealer to exfiltrate sensitive credentials, cryptocurrency wallet data, session tokens, and confidential documents, potentially leading to account compromise, financial theft, and data breaches. Persistence mechanisms ensure continued infection and repeated disabling of security tools after system reboots.

Defensive guidance

Users should avoid downloading software from unofficial or suspicious GitHub repositories and be cautious of promoted search results that may lead to malicious sites. There is no vendor patch available for the malicious driver or infostealer; mitigation relies on user vigilance and blocking access to known malicious domains and repositories. Security teams should monitor for the presence of the Alinubx.sys driver and the Rapuncel infostealer, though detection may be challenging due to the driver's kernel-level capabilities and Microsoft signature. Since the driver is not currently on Microsoft's vulnerable driver blocklist, organizations should watch for updates from Microsoft regarding blocking this driver.

References

bleepingcomputer.com/news/security/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 Sep 2026, 15:31 UTC

References

Community reviews

Related threats