Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools
GitHub-based LastPass impersonation distributed 'Rapuncel' infostealer using a signed driver to kill 145 security tools.
Attackers impersonated LastPass on GitHub, distributing a fake authenticator that deployed an infostealer named 'Rapuncel'. The campaign used a Microsoft-signed kernel driver to disable 145 antivirus and EDR products before stealing credentials from browsers, crypto wallets, and other applications. LastPass and Delphos Labs identified this as a multi-stage malware-as-a-service operation that impersonated at least 40 different companies, with the driver being a renamed version of the known Chinese disk-encryption driver CcProtect.sys.
- Attackers impersonated LastPass on GitHub to distribute the 'Rapuncel' infostealer.
- Campaign used a Microsoft-signed kernel driver to disable 145 security products.
- Shared kit impersonated over 40 companies, operating as a malware-as-a-service.
- Driver bypassed security checks by renaming a known Chinese disk-encryption driver (CcProtect.sys).
- ATT&CK
- T1036.005 Match Legitimate Name or LocationT1562.001 Disable or Modify ToolsT1555.003 Credentials from Password Stores
- Vendors
- MicrosoftGitHubCloudflare
- Products
- LastPass
- Malware
- Rapuncel
From the original article
5 min read at securityaffairs.com
Attackers spoofed LastPass on GitHub, used a Microsoft-signed driver to disable 145 security products, then deployed an infostealer. Someone impersonated LastPass on GitHub, got users to download a fake authenticator, and ended up killing 145 different antivirus and EDR products using a driver that Microsoft itself had signed. That last part is the one worth […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.