Fake LastPass Downloads on GitHub Spread Rapuncel Malware

On 17 September, LastPass published joint research with Delphos into a malware campaign impersonating at least 40 companies. The report reflects their investigation as of 10 September, including a fake LastPass Authenticator GitHub organisation identified in August. This is a new public technical account of an older campaign, not a claim that the attacks began this week.

The researchers describe search-optimised GitHub pages using familiar branding and download buttons to send visitors through redirects to malicious ZIP archives. In the analysed Windows chain, a supposed installer is a renamed Microsoft debugging executable that loads an attacker-controlled companion file. Running it begins the compromise; merely encountering a search result does not.

LastPass explicitly says no LastPass system, service or customer vault was involved or compromised. It says GitHub is not its distribution channel and directs users to lastpass.com and official app stores. Other legitimate developers do distribute software through GitHub, so the useful check is whether the vendor itself links to the exact repository, not a blanket ban on the platform.

The chain attempts to obtain elevated access before deploying a kernel driver and the Rapuncel information stealer. The researchers found a driver signed through Microsoft's hardware compatibility chain, with a hardcoded list of security processes it targets for termination. That signature is not an endorsement of the surrounding download or its purpose.

The report describes theft of browser credentials, wallet files, messaging and gaming session data, selected documents and screenshots. Those are analysed capabilities, not a count of confirmed victims. It also identifies traffic-redirection and hiding features in the driver that were not activated in this deployment; they should not be described as observed interception of every victim's browsing.

Persistence through a Windows service means deleting the downloaded ZIP or restarting is not a demonstrated cure. The report does not establish that every antivirus product always fails, and a clean scan or a reassuring badge on a download page is not independent proof that a file is safe.

Start with the software maker's address or a trusted bookmark and follow its official download route. Check the publisher and destination rather than relying on a high search position, copied logos or an unofficial page's security badges. Do not disable protection to make an unexpected installer work.

If you downloaded but did not execute a suspicious installer, do not open it; remove it and scan the device. If you ran it, stop using that machine for sensitive accounts, disconnect it and contact IT or a trusted recovery specialist. Do not rely on simply uninstalling the apparent app.

From a separate clean device, change affected passwords and revoke sessions or tokens where the service permits. Prioritise email and other accounts that can reset access elsewhere. If recovery codes or other secrets were stored in exposed documents, replace them through the issuing service. This is precautionary recovery advice, not evidence that every listed data type was stolen from a particular reader.

A VPN can protect supported network traffic in transit to its server. It cannot authenticate a software publisher, prevent an installer from obtaining local privileges or recover credentials stolen on the device. Using a VPN does not make a search-sourced installer safe.

Our fake-job-interview warning covers another reason people are persuaded to install unfamiliar software. The delivery pretext differs, but the same boundary applies: independently verify the source before running code, and treat device recovery separately from account recovery.