Fake LastPass Apps Deliver Rapuncel Stealer and a Kernel Driver Targeting Security Tools
Summary
LastPass reports that a months-long impersonation campaign used fake LastPass apps to deliver Rapuncel, an infostealer, and a kernel driver designed to terminate 145 security products. The observed driver lacked configuration to activate its features.
Key points
- Attackers used SEO-optimized GitHub pages to promote fake LastPass Authenticator and macOS apps; LastPass says no internal systems were compromised.
- A hidden chain of GitHub pages and a Cloudflare-fronted server routed victims to a download page, with the final destination changeable by the operator.
- The installer loaded a malicious DLL and Rapuncel, which attempted to gain System privileges and install a kernel driver posing as an NVIDIA component.
- The driver was designed to hide itself and terminate 145 security and antivirus products, but the observed version lacked configuration needed to activate those features.
- Rapuncel sought saved passwords, cryptocurrency wallet files, messaging and gaming tokens, Windows credentials, and documents matching credential or wallet keywords; it also took screenshots and profiled systems.
- LastPass says Rapuncel installs as an automatically starting Windows service and repeatedly checks for and terminates security products.
- LastPass and Delphos found a likely connection to the Cruciferra crypter and behavioral and artifact-level overlap with BoryptGrab; Delphos assessed Rapuncel as a related variant or sibling build.
Article Details
- Event Type
- Impersonation campaign distributing fake LastPass installers, a kernel-level security-tool terminator, and infostealer malware.
- Impact
- The campaign can expose saved browser passwords, cryptocurrency wallet files, messaging and gaming tokens, Windows credentials, and documents containing credential or wallet keywords. Rapuncel also captures screenshots and system details. The kernel driver was designed to terminate 145 security products, but the observed version reportedly lacked configuration needed to activate its hiding and process-injection features. LastPass said no internal systems were compromised.
MITRE ATT&CK
T1055 · Process InjectionThe driver reportedly contains code to inject a helper into running processes, though this feature was not active in the observed iteration.T1082 · System Information DiscoveryRapuncel captures a detailed profile of the system.T1113 · Screen CaptureRapuncel captures screenshots of connected monitors.T1543.003 · Windows ServiceThe malware installs itself as a Windows service configured to start automatically.T1555.003 · Credentials from Web BrowsersRapuncel searches for saved passwords in browsers.T1562.001 · Disable or Modify ToolsThe kernel driver was designed to terminate antivirus and endpoint security products.T1574.002 · DLL Side-LoadingThe fake installer loads a companion DLL containing attacker code, described as DLL side-loading.
Malware
BoryptGrabAdditionally, the campaign shows several overlaps with BoryptGrab, the information stealer that was distributed through roughly 100 GitHub repositories earlier this year.Rapunceldriver designed to terminate 145 security tools and open the door to information-stealing malware called Rapuncel.
Vendors
LastPassA fake LastPass Authenticator distributed via GitHub has led to the discovery of a broad impersonation campaign delivering infostealer malware, LastPass reports.MicrosoftAs part of the campaign, the attackers impersonated at least 40 organizations to push a Microsoft-attested kernel driver designed to terminate 145 security tools and open the door to information-stealing malware calledNvidiato achieve System privileges via built-in Windows features, and installs a kernel driver posing as an NVIDIA graphics component that was designed to terminate 145 antivirus and endpoint security products.
Products
LastPass AuthenticatorA fake LastPass Authenticator distributed via GitHub has led to the discovery of a broad impersonation campaign delivering infostealer malware, LastPass reports.Microsoft WindowsThe Rapuncel malware attempts to achieve System privileges via built-in Windows features, and installs a kernel driver posing as an NVIDIA graphics component that was designed to terminate 145 antivirus and endpoint