Fake LastPass GitHub Repos Push Rapuncel Infostealer

The domain was right. The page said github.com, the badges said the archive had been scanned, and the download button did what download buttons do. What arrived was a 148MB ZIP carrying a renamed Microsoft debugger, a stealer nobody had named yet, and a Microsoft attested kernel driver whose job was to kill the antivirus before either ran.

Key Takeaways

• LastPass and Delphos Labs published a joint analysis in September 2026 naming Rapuncel, a previously undocumented Windows infostealer spread through fake GitHub organizations.
• Two fraudulent organizations, LastPass-Authenticator and LastPass-S, impersonated the password manager, and a single lure host served pages for at least 40 other brands.
• Victims received ZIP archives of 148MB and 127.9MB, padded with junk DLLs so scanners would skip them, holding a renamed copy of Microsoft's vsdbg.exe debugger that sideloads a malicious vsdbg.dll.
• Rapuncel harvests credentials from more than 25 browsers, data from more than 30 cryptocurrency wallets, Discord, Steam and Telegram session tokens, and Windows Credential Manager, then uploads a ZIP to 2.26.126[.]50.
• The bundled Alinubx.sys driver terminates 145 antivirus and EDR processes from kernel mode and showed 0 detections out of 72 on VirusTotal as of 20 August 2026.

How Did a Fake Repo Outrank the Real LastPass?

Because the operators built the lure pages as a search product. The LastPass and Delphos Labs report describes the pages as deliberately SEO optimized to surface on queries like "LastPass Authenticator download", dressed with fabricated trust signals: "Authorized Access", "VirusTotal Approved" and "Secure Archive" badges. None are real. A badge that looks like a scan result exists to kill the one moment of hesitation a user might otherwise have.

The click did not go straight to a payload. Two GitHub Pages accounts, edgarcostartqd.github.io and dallikilic54.github.io, acted as hidden waypoints, and a Cloudflare fronted host, istatlmenus.com, worked as a traffic director. That single endpoint let the operators repoint every lure page at a fresh payload server by editing one record, which is why individual repository takedowns did not end the campaign. Infrastructure changes were observed between 27 August and 10 September 2026.

Most coverage frames this as GitHub abuse. The sharper read is that "it was on GitHub" became a trust cue for non developers told for a decade that official software lives there, and that cue is now being farmed. Same structural problem as the design flaws GitHub declined to fix after the Shai-Hulud worm: the platform's reputation is doing security work the platform never promised to do.

What Is Inside the 148MB Archive?

A legitimate Microsoft binary and a malicious DLL standing next to it. The archives, 148MB and 127.9MB, were inflated with junk files named TitanStorage.dll and ProManager.dll purely as padding, because many scanning pipelines skip files above a size threshold. Bulk is the evasion here, not sloppiness.

The installer itself is a renamed copy of vsdbg.exe, Microsoft's Visual Studio CoreCLR debugger. Windows loads DLLs from an executable's own directory first, so dropping a malicious vsdbg.dll beside it is enough to run attacker code inside a signed Microsoft process. BleepingComputer's write up notes the same chain delivers both Rapuncel and the kernel driver in one pass. Researchers attributed the DLL with high confidence to the Cruciferra PUROSANGUE crypter, and with lower confidence called Rapuncel a sibling build of the BoryptGrab family.

What Does Rapuncel Actually Steal?

Everything a credential broker can resell, in one sweep. Per the Delphos Labs analysis, Rapuncel targets:

• Stored credentials from more than 25 web browsers
• Data from more than 30 cryptocurrency wallet applications
• Discord login tokens, Steam session tokens and Telegram session data
• The contents of Windows Credential Manager
• Any document whose name contains "password", "seed", "wallet" or "recovery"
• Screenshots from every attached monitor

Chrome's app bound encryption ties the local secret store to the browser process so a user mode thief cannot read it. Rapuncel does not break that; it injects code into the browser, impersonates it and asks Chrome's own elevation service to decrypt. It also deletes the registry key HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings, which Chrome uses to verify extension integrity. Loot is zipped and pushed to 2.26.126[.]50 as a POST /upload over raw TCP, retried three times with two second pauses.

The Driver That Kills 145 Security Products

Alinubx.sys should worry a SOC more than the stealer does. It ships disguised as nvfsflt64.sys, an "NVIDIA File System Filter Driver", but researchers identified it as a renamed CcProtect.sys from the CnCrypt encryption product. From kernel mode it terminates a hardcoded list of 145 antivirus and EDR processes, using ObOpenObjectByPointer with kernel access to sidestep the Protected Process Light shielding those agents rely on. On 20 August 2026 it scored 0 of 72 on VirusTotal, carrying a signature chained to the Windows Hardware Compatibility Publisher.

Microsoft's countermeasure for exactly this class of abuse is the vulnerable driver blocklist, which has been enabled by default since the Windows 11 2022 update and is also enforced when memory integrity, Smart App Control or S mode is active. Microsoft updates that list quarterly, with interim rules in monthly servicing. A quarterly cadence is a long time against a driver invisible to every engine on VirusTotal in August. Alinubx.sys also carries dormant capability the operators never switched on: file and registry hiding, DLL injection, and network interception through the Windows Filtering Platform.

Why This Ends in Your Inbox

The report does not list an email client among Rapuncel's targets, and it does not need to. Your webmail password almost certainly sits in one of those 25 browser credential stores or in Windows Credential Manager, and both are on the collection list. Whoever reads either one holds the account every other service uses to verify it is really you.

That ordering matters during cleanup. The instinct is to change the bank password first and email last, which is backwards: while the inbox is reachable, every reset can be intercepted and reversed. Same downstream pattern as the 48 million Gmail logins found in an infostealer database and the 183 million passwords harvested by stealer malware. Rapuncel is one more supplier feeding those pools.

Note who the lure selects for. Someone searching "LastPass Authenticator download" is a person in the act of turning on multifactor authentication, which is precisely the population a credential thief most wants.

What Defenders Can Act On Now

The published indicators are narrow; the behavioural detections outlive them.

• Block and retro hunt outbound traffic to 2.26.126[.]50, and flag HTTP formatted requests over raw TCP to non standard destinations.
• Alert on vsdbg.exe executing outside a real Visual Studio or VS Code install path, especially from a user's Downloads or Temp directory.
• Treat ZIP archives above roughly 100MB arriving via a GitHub Pages redirect chain as suspicious, and raise any scanner size cap that silently skips them.
• Monitor deletion of the Chrome PreferenceMACs extensions.settings registry key, which has no legitimate reason to disappear on a managed endpoint.
• Enable memory integrity or Smart App Control so the driver blocklist is enforced, and turn on the Attack Surface Reduction rule blocking abuse of exploited vulnerable signed drivers.
• On a confirmed infection, reset the user's email password and revoke all active email sessions before touching any other account.
• Install password manager and authenticator apps from the vendor's own domain or the official mobile store, never from a search result. LastPass users should also watch for the fake LastPass and Bitwarden security alert emails circulating this year, which chase the same audience by a different route.

The Pattern Worth Naming

Strip out the malware names and what is left is an advertising funnel: search placement, landing pages with fake trust badges, redirect waypoints, and one switch to change the payload. The stealer at the end of it is interchangeable. The funnel is the durable asset, and it can deliver ransomware just as easily next quarter. A signed binary is not a safe binary, a badge claiming a file was scanned is just pixels, and the result above the fold is the one most worth distrusting. Type the vendor's domain yourself.