Fake LastPass Campaign on GitHub Spreads Infostealer and Disables More Than 145 Security Tools

* The incident involved the LastPass Threat Intelligence, Mitigation, and Escalation team and Delphos Labs.
* A multi-stage malware campaign impersonated the LastPass brand on GitHub to distribute a fake Authenticator installer.
* The fraudulent GitHub page appeared on August 13, 2026, in search results for "LastPass Authenticator download."
* The campaign used LastPass logos and fake trust badges like "VirusTotal Approved" for deception.
* The attack involved a shared toolkit targeting more than 40 companies.
* The infostealer was tracked as Rapuncel by LastPass.
* The attack redirected users through multiple GitHub Pages showing 404 errors before forwarding to a Cloudflare-backed server for malware delivery destination.
* The distribution ZIP archive contained an unnecessary DLL file to inflate size.
* Execution of the file launched a renamed Microsoft debugging tool and loaded a malicious DLL from the same folder.
* The malware escalated privileges to SYSTEM and installed a kernel driver disguised as an NVIDIA component.
* The driver carried a valid signature from the Microsoft Windows Hardware Compatibility Publisher.
* The driver was related to CcProtect.sys.
* The file was renamed to Alinubx.sys to evade hash-based detection.
* Data stolen included files from over 25 browsers, wallet files from over 30 cryptocurrency applications, Discord tokens, Steam sessions, Telegram data, Windows Credential Manager credentials, and screenshots.
* The malware injected into Chrome and Edge to invoke internal decryption services.

The narrative reveals a systemic vulnerability not just in endpoint security but in the implicit trust placed in software provenance, especially within public repositories. The manipulation relies on establishing a veneer of legitimacy—using recognizable branding, valid digital signatures, and clean scan results—to bypass cognitive friction. The use of a kernel-level driver with legitimate Microsoft signatures is particularly potent, as it leverages established system trust to achieve deep system access, effectively neutralizing layered security defenses based on heuristic detection. This pattern suggests attackers are migrating from simple file-based infections to deep, stealthy system compromise leveraging existing infrastructure knowledge (like the CcProtect.sys reference). The collection of diverse data points—browser history, wallet assets, session tokens, and credentials—indicates a pivot toward comprehensive identity theft that exploits the convergence of digital services. The reliance on public, widely trusted platforms like GitHub for malware distribution exposes a flaw in the assumption that brand association equates to security.
BRIDGE QUESTIONS:
If legitimate software distributors were required to use out-of-band verifiable signing mechanisms that were automatically enforced by operating systems or browser trust stores, how would this change user trust dynamics?
What level of systemic auditing is necessary for public code repositories to prevent the embedding of malicious artifacts disguised as legitimate components?
How can security architectures be designed to operate under a principle of inherent distrust of any artifact originating outside strictly controlled, verified distribution channels?