Cybersecurity researchers have uncovered a malware campaign using fake GitHub pages impersonating LastPass Authenticator and dozens of other popular software brands to infect Windows computers.
The campaign delivers a newly documented information-stealing malware called Rapuncel. Once installed, it can steal browser passwords, cryptocurrency wallet data, Telegram and Discord sessions, screenshots and credentials stored on the computer.
LastPass discovered the operation with researchers from Delphos Labs. Their investigation found that the same infrastructure was being used to impersonate at least 40 companies, suggesting a wider malware distribution operation rather than an attack specifically targeting LastPass users.
Importantly, LastPass said none of its systems, services or customer vaults were compromised. Attackers were simply exploiting the company’s name to convince people to download malicious files from outside official LastPass channels.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
Fake GitHub pages appear in software searches
The infection begins when a user searches online for software such as “LastPass Authenticator download”.
Researchers found fake GitHub organisations designed to look like official product pages. They used LastPass logos, product descriptions and prominent download buttons to make the pages appear trustworthy.
The pages were also optimised for search engines. That meant they could appear prominently when someone searched for software, increasing the chances that a victim would click the fraudulent result.
Clicking the download button did not immediately serve the malware.
Instead, victims were silently redirected through several GitHub Pages websites before reaching attacker-controlled servers. This made the infrastructure harder to trace and allowed attackers to hide the final malware delivery location.
The downloaded ZIP archives were deliberately inflated to around 128MB to 148MB using junk files.
The reason was simple: some automated security tools refuse to scan very large files or apply different limits to them. By making the archive unnecessarily large, attackers hoped to reduce the chance of detection.
Rapuncel steals passwords, wallets and account sessions
Inside the malicious archive was what appeared to be a legitimate installer.
Researchers found that the attackers abused Microsoft’s Visual Studio CoreCLR Debugger, vsdbg.exe, to load a malicious DLL. This technique allowed the infection chain to execute malware while hiding behind a legitimate programme.
Once active, Rapuncel searches the victim’s computer for valuable information.
It can steal credentials stored in web browsers, data belonging to cryptocurrency wallets, Windows Credential Manager entries and active sessions from services including Telegram, Discord and Steam.
Researchers also found that it searches for documents containing terms such as “password”, “wallet”, “seed” or “recovery”.
Those words are particularly significant for cryptocurrency users because a wallet seed or recovery phrase can effectively give another person control over the wallet.
Rapuncel can also capture screenshots from connected monitors and collect detailed information about the infected Windows system.
Why a signed driver makes the attack more dangerous
The campaign does not rely on Rapuncel alone.
Researchers discovered a second component called Alinubx.sys, a Windows kernel driver disguised as an NVIDIA-related file. Its job in this campaign is to disable antivirus and endpoint protection tools.
The driver contains a hardcoded list of 145 antivirus and Endpoint Detection and Response processes that it attempts to terminate.
More unusually, the driver carries a Microsoft Windows Hardware Compatibility Publisher signature. At the time of the researchers’ investigation, it had also avoided inclusion in Microsoft’s vulnerable driver blocklist.
A digital signature does not automatically mean a driver is safe.
It generally confirms that the software passed through a signing process and has not been altered since signing. Attackers can still abuse vulnerable or dangerous signed drivers to obtain powerful access inside Windows.
This technique is commonly known as Bring Your Own Vulnerable Driver, or BYOVD. Attackers introduce a legitimate or signed driver with security weaknesses and then abuse its privileged access to disable defensive tools.
Similar GitHub malware campaigns appeared earlier this year
The researchers found strong similarities between Rapuncel and an earlier malware operation known as BoryptGrab.
Trend Micro documented BoryptGrab in March 2026. That campaign also used SEO-optimised fake GitHub repositories, deceptive download pages and oversized archives to distribute information-stealing malware.
Delphos Labs found overlapping techniques and artefacts between the two operations, including similar credential-stealing behaviour and browser encryption bypass methods.
However, researchers stopped short of saying they were definitively operated by the same people. Their assessment is that Rapuncel may be a related variant or part of the same malware ecosystem.
The campaign demonstrates why GitHub itself should not be treated as proof that software is legitimate. Attackers can create repositories and pages that closely mimic real companies while distributing files from entirely separate infrastructure.
What this means for you: Download authentication apps and security software only from the company’s official website or trusted app stores. If you installed software from one of these fake GitHub pages, change stored passwords and cryptocurrency credentials from a separate, clean device and treat saved browser credentials as compromised.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
