Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
A fake LastPass Authenticator installer uses a Microsoft-signed driver to kill EDR, then steals passwords and wallets.
78
Organization
Delphos Labs
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 21, 2026
- Last mentionedSep 21, 2026
Timeline
3 articles · newest firstNew Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools
A new infostealer named Rapuncel uses a Microsoft-signed kernel driver to kill 145 security tools and steal data via fake GitHub repositories.
78
Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords
Hackers are using a Microsoft-signed driver to disable 145 security tools and steal passwords via fake LastPass download pages on GitHub.
78
Appears with
- LastPassorganization · 3
- Microsoftvendor · 3
- LastPassvictim · 2
- GitHubproduct · 2
- Cloudflarevendor · 2
- Alinubx.sysmalware · 2
- Rapuncelmalware · 2
- GitHubvendor · 2
- Henan Dafeng Softwareorganization · 2
- Cloudflareproduct · 2
- Microsoftorganization · 1
- Discordproduct · 1
- LastPass Authenticatorproduct · 1
- Alinubx.sysproduct · 1
- GitHuborganization · 1
- LastPassvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.