AI-generated editorial illustration; not a documentary photograph.
SecurityWeek reported on September 21, 2026, that attackers impersonated LastPass and at least 39 other organizations in a malware campaign using fraudulent installers, GitHub pages and search optimization. The operation delivered Rapuncel, an information stealer paired with a Microsoft-attested kernel driver designed to terminate 145 antivirus and endpoint security products.
Search Results Led to Fake Downloads
The fake LastPass Authenticator page appeared prominently in searches for the legitimate application. A separate page offered a fraudulent macOS LastPass app, while a routing chain spanning several GitHub pages and a Cloudflare-fronted server allowed the operators to change the final destination. LastPass said the server remained active on September 10 and had been updated since August 27.
A Driver Targeted Security Software
On Windows, the downloaded archive contained a fake installer, a malicious file and filler content. The installer was a renamed Microsoft debugging utility that loaded the attackers' DLL. Rapuncel then attempted to obtain System privileges and installed a kernel driver disguised as an NVIDIA graphics component. LastPass found code for hiding the driver and injecting a helper into running processes, although those functions lacked the required configuration in the observed version and did not activate.
Credentials and Wallet Data at Risk
After suppressing security tools, Rapuncel searched for saved passwords across 25 browsers, files associated with 30 cryptocurrency wallet applications, messaging and gaming tokens, Windows credentials, and documents containing credential or wallet terms. LastPass also reported that the malware captured every connected display, collected a detailed system profile and installed a persistent Windows service that repeatedly restarted the theft process and disabled returning security products.
LastPass Systems Were Not Breached
LastPass characterized the lure as opportunistic brand impersonation and said its internal systems were not compromised. Its investigation with Delphos connected the malicious DLL to the Cruciferra crypter service's PUROSANGUE package. Delphos also found strong behavioral and artifact similarities with BoryptGrab, but said Rapuncel was not byte-identical and assessed it as a related variant or sibling build.
Source: Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer
SIGNAL TITANS
Leave a Reply