Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer

A widespread campaign impersonates LastPass and at least 40 other companies to distribute a kernel-level malware called Rapuncel via fake installers hosted on GitHub. The malware disables 145 security products by loading a malicious kernel driver and steals sensitive information including passwords, cryptocurrency wallets, and tokens from multiple applications. The campaign uses SEO manipulation and dynamic redirect chains to lure victims. Rapuncel installs as a persistent Windows service, continuously killing security tools and stealing data until the kernel driver is physically removed.

• securityweek.com/fake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer/ (opens in a new tab)

• Want to Rent an Internet Address at the White House?News2026-11-05
• Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into ProxiesBotnet2026-11-03
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion pathsAnalysis2026-10-30
• How to download and read ebooks safely | Kaspersky official blogAnalysis2026-10-30