Summary
- LastPass and Delphos Labs identified search-optimised repositories impersonating at least 40 software companies.
- The campaign installs Rapuncel and a Microsoft-attested kernel driver configured to terminate processes belonging to 145 security products.
- The attack exploits trust in search results, software brands, code-hosting platforms, and signed drivers rather than compromising the genuine vendors.
Fake software repositories impersonating LastPass and dozens of other technology companies are being used to distribute a newly documented information stealer alongside a signed kernel driver designed to terminate security software.
LastPass and Delphos Labs uncovered the campaign, which uses search-optimised GitHub repositories to imitate genuine software downloads. The researchers said the operation impersonated LastPass and at least 39 other companies.
The repositories distribute malware named Rapuncel. They also deliver a kernel driver configured with a hardcoded list of processes associated with 145 antivirus and endpoint detection and response products.
The campaign does not depend on compromising the legitimate LastPass service or the genuine software vendors whose brands are copied. Its entry point is search: a user looking for software follows a convincing result to a repository designed to resemble an official distribution location.
Download links then redirect the target through several stages before delivering a ZIP archive. The campaign uses a renamed copy of Microsoft’s Visual Studio debugger to sideload a malicious DLL, which ultimately installs the information stealer and the driver.
Researchers said the driver is signed through Microsoft’s Windows Hardware Compatibility Publisher chain. It attempts to terminate protected security processes by performing operations from kernel mode, allowing it to interfere with controls that are deliberately resistant to ordinary user-mode termination.
A valid signature does not mean Microsoft authored or approved the malicious campaign. Driver-signing mechanisms establish properties about a submitted driver and its signing chain, but attackers have repeatedly sought ways to abuse legitimately signed or vulnerable drivers because kernel privileges can bypass controls operating at a lower trust level.
Once security processes are disrupted, Rapuncel collects credentials and other data. Researchers documented targeting of browser credentials, cryptocurrency wallets, Windows Credential Manager contents, sessions for services including Discord and Telegram, screenshots, and files whose names suggest they may contain passwords or recovery material.
The malware also attempts to persist across reboots through a Windows service. That allows it to repeat the process of terminating security tooling before the stealer launches again.
The campaign combines several independent trust signals: a familiar software brand, a GitHub repository, a prominent search result, legitimate Microsoft tooling, and a signed driver. None of those signals alone proves a download is genuine, but together they can make a malicious installation path appear credible.
That is particularly relevant to enterprise identity security because information stealers are increasingly used as an upstream source of authenticated access. Browser sessions, stored credentials, developer accounts, and cloud identities taken from one workstation can later be sold or reused in attacks that no longer resemble the malware campaign responsible for obtaining them.
GitHub is also a natural lure because legitimate software companies and open-source projects routinely use it for distribution. Blocking the platform wholesale is impractical for many engineering organisations, increasing the importance of distinguishing a vendor’s genuine organisation and release process from repositories built to imitate it.
Rapuncel therefore sits at the intersection of endpoint compromise and software-provenance risk. The malware is technically capable, but the initial advantage comes from persuading a user that an untrusted distribution path is part of a legitimate vendor’s software supply chain.
