LastPass Authenticator Lure Leads to Widespread Impersonation Campaign, Kernel-Level EDR Killer
A sophisticated impersonation campaign has been unfolding on GitHub, where attackers have distributed a fake LastPass Authenticator, leading to the delivery of infostealer malware called Rapuncel. At least 40 organizations have been impersonated as part of this broad effort, which involves pushing a Microsoft-attested kernel driver designed to terminate 145 security tools and pave the way for information-stealing malware.
The attackers’ scheme relies on opportunistic brand spoofing, with no internal LastPass systems compromised. The fake LastPass lure was discovered on August 13, but it’s believed that the campaign has been active for several months. Using SEO optimization, the attackers’ GitHub page serving the fraudulent LastPass Authenticator was among the top search results for users looking for the legitimate application. Another page offered a fake macOS LastPass application.
The attackers used a complex routing chain, involving multiple GitHub pages and a Cloudflare-fronted server, to direct victims to the final destination, which could be changed dynamically by the operator. The server remained active as of September 10, with its content updated between August 27 and September 10, indicating ongoing maintenance. Ultimately, victims were taken to a download page serving an archive containing a fake installer, malicious file, and junk.
When executed, the installer – a renamed version of Microsoft’s debugging tool – would load a companion DLL containing the attacker’s code. The Rapuncel malware attempts to achieve System privileges using built-in Windows features and installs a kernel driver posing as an NVIDIA graphics component. This driver contains code to hide itself and inject a helper into every running process, although the observed iteration lacked the necessary configuration and did not activate these features.
Once security tools are shut down, the malware starts looking for saved passwords in 25 browsers, cryptocurrency files of 30 wallet applications, Discord tokens, Steam tokens, Telegram data, Windows credential store, and documents containing credential and wallet keywords. Rapuncel also takes a screenshot of every connected monitor and captures a detailed profile of the system.
The investigation into the campaign, conducted in collaboration with Delphos, revealed a connection to Cruciferra, a crypter service recently detailed by Proofpoint, through the malicious DLL loaded during the infection chain. The DLL was likely produced using the Cruciferra package called PUROSANGUE, which was previously used to create other side-loaded DLLs containing EDR/AV-killing code.
Furthermore, the campaign shows overlaps with BoryptGrab, an information stealer distributed through approximately 100 GitHub repositories earlier this year. Delphos compared the Rapuncel stealer payload directly against Trend Micro’s documented BoryptGrab samples and found strong behavioral and artifact-level overlap, assessing Rapuncel as a BoryptGrab-related variant or sibling build.
The takeaways from this campaign are clear: attackers continue to exploit brand recognition and user trust in popular applications. Users should exercise caution when downloading software from unverified sources, and organizations should remain vigilant against impersonation campaigns and ensure their security tools are up-to-date and functioning correctly.
Source: SecurityWeek — 2026-09-21