A malware delivery operation is using search-optimised GitHub repositories to impersonate well-known software brands and push a previously undocumented information stealer called Rapuncel. The payload arrives with a Microsoft-signed kernel driver built to switch off the security software meant to catch it.
What happened
LastPass and Delphos Labs documented the campaign after finding a fake GitHub organisation posing as LastPass Authenticator and ranking near the top of search results for download queries. The same kit was serving impersonation pages for at least 40 brands. From the fake repository, a download button leads through hidden GitHub Pages redirectors to an attacker server, which returns a ZIP archive padded to 127.9 MB or 148 MB so that scanners with file-size limits skip it.
Inside the archive, the supposed installer is a renamed copy of Microsoft's own Visual Studio debugger, vsdbg.exe, which loads an attacker-supplied vsdbg.dll from the same folder. That loader installs Rapuncel plus a kernel driver disguised as an NVIDIA component, nvfsflt64.sys. The driver carries a hardcoded list of 145 antivirus and endpoint detection products and terminates them from kernel mode, which defeats the Protected Process Light protection many of them rely on. It is signed through Microsoft's Windows Hardware Compatibility Publisher chain and was not on Microsoft's blocked-driver list.
Rapuncel then pulls saved passwords from more than 25 browsers, wallet files from around 30 cryptocurrency applications, Discord, Steam and Telegram session data, and the Windows Credential Manager. For Chrome and Edge it injects code into the browser process to defeat app-bound encryption. It also collects screenshots and any document named with words like password, seed, wallet or recovery, then uploads the archive to an attacker server and persists as a Windows service. LastPass states that no LastPass system or customer vault was involved; the brand was borrowed, and GitHub is not a distribution channel for the product.
Who is affected
Any Windows workstation where a user downloaded software from a search result and ran the installer. The design defeats the controls small organisations rely on most.
- Users who search for an installer and click a GitHub link instead of going to the vendor site
- Machines protected only by antivirus or an EDR agent that trusts Microsoft-signed drivers
- Environments where users hold local administrator rights and can approve the installer's elevation prompt
What to do now
Assume any machine that ran one of these installers is fully compromised, including saved browser passwords and cached Microsoft 365 sessions. Removing the stealer is not enough on its own.
- Pull the affected machine off the network, remove the driver in safe mode or rebuild it, then rotate every credential that was stored on it.
- Revoke active sessions and refresh tokens for Microsoft 365 and any other single sign-on account used from that machine, and reset passwords from a clean device.
- Block the campaign's payload and redirect domains at the proxy and DNS layer, and alert users that GitHub results are not a vendor download channel.
- Check the driver blocklist on endpoints and remove local administrator rights from standard users.
What this means for South African businesses
The practical danger for a South African SME is not the stealer itself but the signature: a Microsoft-attested driver tells Windows, and most endpoint tools, that the file is legitimate, so nothing alerts until credentials are already gone. Because the same kit impersonates 40 brands, this is not a LastPass problem and blocking one repository achieves nothing. If your users routinely download software from search results and hold local admin rights, treat this as a present risk rather than a theoretical one.
Source: BleepingComputer, reporting research published by LastPass and Delphos Labs.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.