The Rapuncel infostealer turns an ordinary software search into a path to credential theft. In research published September 17, 2026, LastPass and Delphos Labs described a campaign that impersonated at least 40 companies through polished, search-optimized GitHub repositories and delivered malware that could disable security tools before stealing data.
This matters now because the attack does not begin with an obviously suspicious attachment. It begins when someone searches for legitimate software, trusts a familiar brand on a familiar platform, and downloads what appears to be a professionally packaged installer. For businesses, the immediate lesson is clear: search rank, GitHub hosting, a clean scan, and a valid digital signature are signals, not proof that a download is safe.
Key Stat: The malicious kernel driver carried a hardcoded list of 145 antivirus and EDR processes to terminate, according to the joint LastPass and Delphos analysis.
What the Rapuncel infostealer campaign did
LastPass and Delphos published their joint technical report on September 17. They found fraudulent GitHub organization pages designed to rank for searches such as “LastPass Authenticator download.” The campaign also impersonated at least 39 other companies, showing that LastPass was one lure in a reusable malware distribution operation.
No LastPass system, service, or customer vault was breached. The attackers used the company’s name and visual identity outside official LastPass channels. That distinction matters because affected users were not compromised by using the real product. They were targeted while trying to find it.
The observed path moved through several layers:
- A search result led to a fake GitHub organization page.
- A prominent download button opened a convincing GitHub Pages site.
- Fabricated trust badges and animations reassured the visitor.
- Hidden redirectors obscured the final payload infrastructure.
- An automatically downloaded ZIP archive delivered the installer chain.
- DLL side-loading launched the stealer and a kernel-level defense killer.
BleepingComputer’s September 18 coverage reported that some ZIP files were inflated to as much as 148 MB, a tactic that can interfere with automated scanning. The installer used a legitimate Microsoft Visual Studio debugging executable renamed and configured to side-load a malicious DLL.
This is not a single fake download page. It is a delivery system built to borrow credibility at every stage.
Why fake GitHub repositories are convincing
GitHub is essential to modern software development, but a repository is not automatically an official release channel. Anyone can create an account, copy product descriptions, add polished documentation, and link to an external download.
Attackers benefit from a powerful assumption: if a page is hosted on GitHub and appears near the top of search results, it must have been reviewed. Neither signal proves publisher identity. As Malwarebytes explains in its GitHub safety guidance, GitHub is not an app store and does not vet every repository or binary for safety.
The Rapuncel campaign strengthened that illusion with:
- brand names, logos, and product descriptions copied from real companies
- search-engine optimization designed to surface the lure
- fake “authorized,” “approved,” and “secure” trust indicators
- several GitHub Pages waypoints that hid the final destination
- a legitimate executable used as the visible installer component
- a Microsoft-signed driver that looked trustworthy to basic checks
Each element lowers suspicion. Together, they can defeat a user’s normal mental checklist.
Common Mistake: Treating the GitHub domain as proof that the repository belongs to the vendor named on the page. Verify the organization through the vendor’s official website, not through the search result that brought you there.
How Rapuncel steals data and disables defenses
The campaign paired information theft with a bring-your-own-vulnerable-driver technique, often shortened to BYOVD. That combination is important because an infostealer is much harder to remove when it can repeatedly terminate the tools expected to detect it.
The credential theft payload
The Rapuncel infostealer targets high-value data stored on a Windows endpoint. Reported targets included browser credentials, cryptocurrency wallets, Discord, Steam and Telegram sessions, Windows Credential Manager contents, screenshots, system details, and documents whose names contained terms such as password, seed, wallet, or recovery.
It also used a helper DLL to get around app-bound encryption protections in Chromium-based browsers. Stolen data was compressed and sent to attacker infrastructure.
This creates risk beyond the initially infected computer. Browser sessions and stored credentials can open email, SaaS, cloud, financial, developer, and administrative accounts. A single unmanaged download can therefore become an identity incident across several services.
Hexon’s guide to Claude session hijacking and infostealer abuse explains why resetting one password is often insufficient. Stolen session cookies and tokens may remain useful until sessions are explicitly revoked.
The signed kernel driver
The second payload was a renamed kernel driver called Alinubx.sys in the research. It was dropped under a filename that made it look like an NVIDIA component and installed as a Windows service.
The driver could terminate processes from kernel mode. According to the researchers, it contained the names of 145 antivirus and EDR processes and could defeat protections designed to keep security software alive. The malware then persisted as a service, repeatedly checking whether defensive products had restarted and killing them again.
The driver carried a signature through the Microsoft Windows Hardware Compatibility Publisher chain and reportedly had zero detections across 72 VirusTotal engines when checked during the investigation. It was also absent from the Microsoft vulnerable driver blocklist used by the researchers at that time.
That does not mean code signing failed completely. It means teams must understand what a signature proves. A signature establishes a relationship to a signing process and helps detect tampering. It does not guarantee that every capability in the signed component is safe in every context.
Key Takeaway: “Signed” and “not currently detected” are useful attributes, but neither should override publisher provenance, behavior, or an application-control policy.
Rapuncel infostealer defenses for teams
The strongest defense starts before execution. Small and midsize businesses may not have a dedicated malware analysis team, but they can still remove the assumptions this campaign depends on.
1. Start from the vendor’s official domain
Build the habit of navigating to the known vendor website first, then following its download or repository link. Do not search for a product name plus “download” and trust the first result.
For managed environments, maintain an internal software catalog with approved links and versions. A short list of common tools is easier to maintain than an unrestricted rule that leaves every employee to judge repository authenticity.
2. Verify the publisher, not just the page
When GitHub is the legitimate release channel, confirm that the vendor’s own website links to the organization. Review the account history, release history, maintainers, tags, checksums, and whether the download stays within the expected release workflow.
Be suspicious when a mature brand appears under a newly created organization, a download button redirects to unrelated domains, or the repository provides binaries without meaningful source, issues, releases, or contributor history.
3. Control software execution
Standard users should not install arbitrary applications or drivers. Use an allowlist where practical, especially on finance, administration, engineering, and privileged support devices.
This is also a reason to separate daily browsing from administrative work. If an employee searches for utilities while signed in with local administrator rights, a deceptive installer receives a much shorter path to system-level persistence.
Hexon’s small business office network security guide covers device inventory, segmentation, and administrator separation that can limit the blast radius when one workstation is compromised.
4. Harden against vulnerable driver abuse
Microsoft recommends enabling memory integrity where possible, keeping the vulnerable driver blocklist current, and using the Attack Surface Reduction rule that blocks abuse of exploited vulnerable signed drivers.
Test application-control changes before broad enforcement because driver blocks can cause compatibility problems. Security teams should also monitor Code Integrity events and unexpected driver or service creation, rather than assuming a default blocklist will catch every variant.
5. Monitor for defense tampering
An EDR agent going offline is an incident signal, not a routine support nuisance. Alert when multiple security services stop, a new kernel driver loads, a workstation creates an unfamiliar auto-start service, or telemetry disappears immediately after software installation.
Correlate those events with DNS, proxy, software inventory, identity, and browser download data. The point is to see the sequence: search, download, execution, defense loss, credential access, and outbound transfer.
Pro Tip: Add official download domains for your most-used applications to the internal software catalog. This turns a risky web search into a repeatable, reviewable process.
How to respond to suspected Rapuncel exposure
If someone downloaded or ran software from a suspected fake repository, treat the event as both an endpoint compromise and a credential compromise. Do not rely on a clean antivirus scan from the affected machine.
Start with these actions:
- Isolate the device from the network. Preserve power if your incident-response process requires live evidence, but stop routine access to business systems.
- Use a known-clean system for account recovery. Change passwords, revoke sessions, rotate recovery codes, and review MFA methods from another device.
- Prioritize high-impact accounts. Address email, password managers, identity providers, cloud consoles, developer platforms, finance tools, and remote-access services first.
- Review driver and service persistence. Look for unexpected kernel drivers, newly created services, security-product failures, and the filenames and indicators published by the researchers.
- Collect network and identity evidence. Review outbound connections, new logins, token use, mailbox rules, OAuth grants, API keys, and access from unfamiliar locations.
- Rebuild when trust cannot be restored. If kernel-level malware ran, a clean reimage is usually safer than assuming file deletion returned the endpoint to a known state.
If the user handled source code, cloud credentials, or deployment secrets, extend the investigation to repositories and CI/CD systems. Hexon’s domain registrar security checklist also provides a useful priority model for protecting accounts whose compromise can redirect an entire organization’s traffic.
Document every revoked session and rotated credential. Infostealer response becomes chaotic when teams reset passwords but forget API tokens, browser sessions, SSH keys, recovery paths, or credentials stored in local files.
What security leaders should change this week
The Rapuncel infostealer campaign is a practical test of software intake. Ask a simple question: how does an employee obtain a new tool today?
If the answer is “search the web and use judgment,” the organization has delegated publisher verification to people under time pressure. Replace that ambiguity with a small set of controls:
- publish approved software sources and ownership contacts
- require vendor-domain verification before using GitHub downloads
- remove local administrator rights from standard work
- enable and test Windows driver-abuse protections
- alert on security-service termination and new driver installation
- rehearse session revocation and clean-device credential recovery
- teach staff that search ranking and code signing are not safety guarantees
These controls address more than one malware family. They reduce exposure to fake installers, SEO poisoning, trojanized utilities, malicious repositories, and signed-driver abuse.
The Rapuncel infostealer succeeded by chaining credible signals into a false story: a known brand, a high search position, a trusted hosting platform, a legitimate executable, a valid signature, and clean scan results. Defenders should break that story at the first step by making provenance verifiable and software installation controlled.
The safest download path is not the page that looks most convincing. It is the one you can trace back to the publisher before anything runs.