530/69 Friday, September 25, 2026
The LastPass Threat Intelligence, Mitigation, and Escalation team, together with Delphos Labs, disclosed a multi-stage malware campaign impersonating the LastPass brand on GitHub to trick users into downloading a fake LastPass Authenticator installer. The fraudulent GitHub page was discovered on August 13, 2026, after appearing in search results for “LastPass Authenticator download.” It used LastPass logos and branding to appear legitimate and displayed fake trust badges such as “VirusTotal Approved” to encourage users to download the file. LastPass confirmed that the incident was a case of brand impersonation, not a compromise of LastPass itself, and that no LastPass systems, services, or customer vaults were breached. The official distribution channels for LastPass Authenticator are the lastpass.com website and official app stores, not GitHub.
Payload analysis showed that the campaign was not limited to impersonating LastPass, but was part of a shared toolkit used to impersonate more than 40 companies through the same infrastructure, resembling a Malware-as-a-Service operation. LastPass tracks the infostealer as Rapuncel. The attack redirects users through multiple GitHub Pages that appear to show 404 error pages before forwarding them to a server behind Cloudflare, which determines the malware delivery destination. The ZIP archive used for distribution contains a large, unnecessary DLL file designed to inflate the archive size beyond the limits of some automated scanning systems. When the user executes the file, the fake installer launches a renamed Microsoft debugging tool and loads a malicious DLL from the same folder. The malware then escalates privileges to SYSTEM and installs a kernel driver disguised as an NVIDIA component.
A key aspect of the campaign is that the driver carries a valid signature from the Microsoft Windows Hardware Compatibility Publisher, allowing it to bypass certain security checks and disable up to 145 antivirus and Endpoint Detection and Response (EDR) products. Delphos stated that the driver is related to CcProtect.sys
, a Chinese disk-encryption driver previously listed in the LOLDrivers project, for which Proof-of-Concept code capable of disabling security tools is already publicly available. The attackers renamed the file to Alinubx.sys
to evade hash-based detection. After disabling security defenses, the malware steals data from more than 25 browsers, wallet files from over 30 cryptocurrency applications, Discord tokens, Steam sessions, Telegram data, Windows Credential Manager credentials, and screenshots from every connected display. It also injects into Chrome and Edge to invoke the browsers’ internal decryption services. The campaign undermines several common trust assumptions at the same time, including GitHub repositories using well-known brand names, files carrying valid Microsoft signatures, clean VirusTotal scan results, and blocklists that do not yet contain the malicious files. Users should therefore download authentication tools and security software only from official distribution channels and should investigate their systems if they have recently downloaded such software from unverified GitHub links.