--- title: Fake LastPass Authenticator GitHub repos push new... description: A malware campaign uses SEO-optimized, fake GitHub repositories impersonating LastPass Authenticator and at least 39 other software brands to distribute a new... canonical: https://daily.dev/posts/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer-a8pqgzb0a twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer | daily.dev og:description: A malware campaign uses SEO-optimized, fake GitHub repositories impersonating LastPass Authenticator and at least 39 other software brands to distribute a new... og:url: https://daily.dev/posts/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer-a8pqgzb0a og:image: https://api.daily.dev/og/posts/a8PqGZB0a.png og:image:alt: Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 1 upvotes · 1 comments ## Summary A malware campaign uses SEO-optimized, fake GitHub repositories impersonating LastPass Authenticator and at least 39 other software brands to distribute a new infostealer called Rapuncel. Victims searching for popular software follow links to bogus repos, download oversized ZIP archives (up to 148MB) designed to evade scanning, and run an installer disguised as Microsoft's legitimate vsdbg.exe debugger that sideloads a malicious DLL. Alongside Rapuncel, the campaign deploys a Microsoft-signed kernel driver, Alinubx.sys, disguised as an NVIDIA component, which can terminate 145 antivirus and EDR products by abusing kernel-mode object access to bypass Protected Process Light protections. Once security tools are killed, Rapuncel steals browser credentials from 25 browsers, data from 30 crypto wallets, Discord/Steam/Telegram sessions, Windows Credential Manager contents, sensitive documents, and screenshots, exfiltrating everything to a remote server. Researchers assess Rapuncel is likely a variant of BoryptGrab built with the Cruciferra PUROSANGUE crypter, and the malicious driver is not yet on Microsoft's vulnerable drivers blocklist. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the Alinubx.sys kernel driver bypass antivirus and EDR protections like Protected Process Light? It calls ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode SeAccessCheck path at handle-open time, letting the driver open a protected process as kernel code and kill it. This defeats Protected Process Light (PPL), which many security products rely on to survive termination attempts by an administrator. The driver carries a hardcoded list of 145 antivirus and EDR processes to terminate and is signed through Microsoft's Windows Hardware Compatibility Publisher chain. _Security teams tracking EDR-killer techniques can follow driver-abuse research like this on daily.dev._ ### What data does the Rapuncel infostealer steal from infected Windows machines? Rapuncel collects credentials from 25 web browsers, data from 30 cryptocurrency wallets, Discord, Steam, and Telegram session credentials, Windows Credential Manager contents, documents containing words like password, seed, wallet, or recovery, screenshots from every connected monitor, and detailed system information. It bypasses Chrome and Edge's app-bound encryption by injecting a helper DLL and invoking its own Elevation Service, then uploads stolen data over raw TCP to a remote server. _Anyone hardening endpoints against infostealers can track threat details like these on daily.dev._ ### How are attackers distributing malware through fake GitHub repositories impersonating software like LastPass Authenticator? Attackers create SEO-optimized GitHub repositories impersonating LastPass Authenticator and at least 39 other companies, so victims searching for the software land on fake repos. Clicking a download button triggers redirects to payload servers delivering ZIP archives inflated to as much as 148MB to dodge security scans; inside is a renamed copy of Microsoft's legitimate vsdbg.exe debugger configured to sideload a malicious DLL. _Developers vetting third-party tools on GitHub can stay ahead of impersonation scams via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@akkitto** · 0 upvotes > "Microsoft-signed" > > So, Microsoft is able to track a strawman down, who ordered that? ## Similar posts on daily.dev - [Malicious GitHub Campaign: Fake “Arctic Wolf” and 290\+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer](https://daily.dev/posts/malicious-github-campaign-fake-arctic-wolf-and-290-brand-impersonation-repositories-deliver-bory-pfw4ug3ql) · Arctic Wolf · 3 upvotes · 0 comments - [New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages](https://daily.dev/posts/new-boryptgrab-stealer-targets-windows-users-via-deceptive-github-pages-yrwqhjw1f) · Trend Micro · 0 upvotes · 0 comments - [Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding](https://daily.dev/posts/fake-games-spread-stealers-with-renpy-loader-msbuild-and-etherhiding-zkfrqypzs) · Security Boulevard · 0 upvotes · 0 comments - [GitHub Impersonation Deploys Information Stealer](https://daily.dev/posts/github-impersonation-deploys-information-stealer-fm6cyj2u0) · Arctic Wolf · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer-a8pqgzb0a) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer","url":"https://daily.dev/posts/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer-a8pqgzb0a","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer-a8pqgzb0a"},"datePublished":"2026-09-18T15:22:10.879Z","dateModified":"2026-09-18T15:22:50.691Z","description":"A malware campaign uses SEO-optimized, fake GitHub repositories impersonating LastPass Authenticator and at least 39 other software brands to distribute a new...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/84168801f2e46bac8f9b609154f4a39e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/84168801f2e46bac8f9b609154f4a39e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer-a8pqgzb0a","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,github,malware","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer-a8pqgzb0a","comment":[{"@type":"Comment","text":"“Microsoft-signed”\nSo, Microsoft is able to track a strawman down, who ordered that?","datePublished":"2026-09-19T09:10:53.510Z","url":"https://daily.dev/posts/a8PqGZB0a#c-iywLPShfR","author":{"@type":"Person","name":"Daniel","url":"https://daily.dev/akkitto","image":"https://media.daily.dev/image/upload/s--FtwJqX4c--/f_auto/v1754900041/avatars/avatar_29TCpY2hJR72V3BlxPXzX?_a=BAMClqZW0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer-a8pqgzb0a#faq","mainEntity":[{"@type":"Question","name":"How does the Alinubx.sys kernel driver bypass antivirus and EDR protections like Protected Process Light?","acceptedAnswer":{"@type":"Answer","text":"It calls ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode SeAccessCheck path at handle-open time, letting the driver open a protected process as kernel code and kill it. This defeats Protected Process Light (PPL), which many security products rely on to survive termination attempts by an administrator. The driver carries a hardcoded list of 145 antivirus and EDR processes to terminate and is signed through Microsoft's Windows Hardware Compatibility Publisher chain. Security teams tracking EDR-killer techniques can follow driver-abuse research like this on daily.dev."}},{"@type":"Question","name":"What data does the Rapuncel infostealer steal from infected Windows machines?","acceptedAnswer":{"@type":"Answer","text":"Rapuncel collects credentials from 25 web browsers, data from 30 cryptocurrency wallets, Discord, Steam, and Telegram session credentials, Windows Credential Manager contents, documents containing words like password, seed, wallet, or recovery, screenshots from every connected monitor, and detailed system information. It bypasses Chrome and Edge's app-bound encryption by injecting a helper DLL and invoking its own Elevation Service, then uploads stolen data over raw TCP to a remote server. Anyone hardening endpoints against infostealers can track threat details like these on daily.dev."}},{"@type":"Question","name":"How are attackers distributing malware through fake GitHub repositories impersonating software like LastPass Authenticator?","acceptedAnswer":{"@type":"Answer","text":"Attackers create SEO-optimized GitHub repositories impersonating LastPass Authenticator and at least 39 other companies, so victims searching for the software land on fake repos. Clicking a download button triggers redirects to payload servers delivering ZIP archives inflated to as much as 148MB to dodge security scans; inside is a renamed copy of Microsoft's legitimate vsdbg.exe debugger configured to sideload a malicious DLL. Developers vetting third-party tools on GitHub can stay ahead of impersonation scams via daily.dev."}}]} ```