Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
Fake LastPass Authenticator GitHub repos spread new Rapuncel infostealer alongside a Microsoft-signed kernel driver that kills 145 antivirus and EDR products.
LastPass and Delphos Labs uncovered an ongoing campaign using SEO-optimized GitHub repositories impersonating LastPass and at least 39 other companies to deliver the previously undocumented Rapuncel infostealer. Oversized ZIPs up to 148MB carry vsdbg.exe sideloading a malicious vsdbg.dll, which deploys Rapuncel and the Alinubx.sys kernel driver (signed via Microsoft's Windows Hardware Compatibility Publisher chain) that terminates 145 AV/EDR processes and bypasses Protected Process Light via kernel-mode handle opens. Rapuncel steals credentials from 25 browsers, 30 cryptocurrency wallets, Discord, Steam, and Telegram sessions, bypasses Chrome's app-bound encryption via DLL injection, and exfiltrates data to 2.26.126[.]50 over raw TCP; researchers assess with moderate confidence it is a BoryptGrab variant.
- Attack starts via SEO-poisoned GitHub repos posing as LastPass Authenticator
- vsdbg.exe is abused for DLL side-loading to deploy the payload
- Signed Alinubx.sys driver kills 145 AV/EDR products and defeats PPL
- Steals data from 25 browsers, 30 crypto wallets, and messaging apps
- Persists via a Windows service and exfiltrates over raw TCP
- ATT&CK
- T1566.002 Spearphishing LinkT1574.002 DLL Side-LoadingT1562.001 Disable or Modify ToolsT1555.003 Credentials from Web BrowsersT1543.003 Windows Service
- Vendors
- LastPassDelphos LabsGitHub
- Products
- LastPass Authenticator
- Malware
- RapuncelBoryptGrab
From the original article
2 min read at bleepingcomputer.com
An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.