Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools
GitHub-based LastPass impersonation distributed 'Rapuncel' infostealer using a signed driver to kill 145 security tools.
75
Malware
Rapuncel
- Mentions · 7d0
- Mentions · 30d0
- All mentions6
- First seenSep 18, 2026
- Last mentionedSep 23, 2026
Timeline
6 articles · newest firstAWS Strands Agents Team Releases Strands Harness: An Open-Source Agent Harness With 28% Lower Token Cost at Comparable Accuracy
AWS Strands Agents Team releases a general-purpose agent harness with 28% lower cost at comparable accuracy across 6 benchmarks.
0
Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer
Fake LastPass installers triggered an infostealer malware campaign targeting at least 40 organizations, exploiting kernel-level EDR killers and stealing passwords and wallet data.
90
New Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools
A new infostealer named Rapuncel uses a Microsoft-signed kernel driver to kill 145 security tools and steal data via fake GitHub repositories.
78
Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords
Hackers are using a Microsoft-signed driver to disable 145 security tools and steal passwords via fake LastPass download pages on GitHub.
78
Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
Fake LastPass Authenticator GitHub repos spread new Rapuncel infostealer alongside a Microsoft-signed kernel driver that kills 145 antivirus and EDR products.
65
Appears with
- Microsoftvendor · 5
- GitHubvendor · 4
- Microsoftorganization · 3
- LastPassproduct · 3
- Cloudflarevendor · 3
- Henan Dafeng Softwareorganization · 2
- GitHubproduct · 2
- Cloudflareproduct · 2
- LastPassvictim · 2
- Alinubx.sysmalware · 2
- LastPassorganization · 2
- Delphos Labsorganization · 2
- OpenAIvendor · 1
- 40 organizationsvictim · 1
- Hugging Faceai model · 1
- DaVinci Resolveproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.