Fake GitHub repositories reportedly begin distributing Rapuncel infostealer

Search results lead to imitation repositories

BleepingComputer reported that LastPass and Delphos Labs identified a campaign impersonating LastPass and at least 39 other companies through search-optimized GitHub repositories.

The report says download links lead through redirects to ZIP archives containing Rapuncel and a driver identified as Alinubx.sys. Researchers said the driver, disguised as an NVIDIA component, targets 145 antivirus and endpoint detection and response processes.

Rapuncel had not previously been documented in the report's account.

A reported malware campaign now uses search-optimized fake GitHub repositories impersonating LastPass and other software companies to distribute the previously undocumented Rapuncel infostealer, alongside a Microsoft-signed kernel driver.

A signed driver intended to disable defenses

The reported distribution route combines software-brand impersonation in search results with a signed kernel-level component that researchers say is intended to disable security products before data theft.