LastPass, in collaboration with Delphos Labs, has uncovered a new infostealer malware variant dubbed "Rapuncel" that exploits GitHub's reputation as a trusted software distribution platform.
The attack begins with SEO-optimized fake GitHub repositories that impersonate legitimate software — LastPass itself was one of the impersonated brands. The fake repos use official logos, product descriptions, and marketing text to appear convincing, directing victims to download malicious ZIP files through GitHub Pages sites.
What makes Rapuncel particularly dangerous is its use of a kernel-level driver that carries a valid signature from Microsoft's Hardware Compatibility Program. This allows the malware to operate at the highest privilege level on Windows, disabling 145 known antivirus and endpoint detection and response (EDR) systems. Because the command comes from kernel level, the security systems have no defense, and Windows raises no alarms since the driver bears an official Microsoft signature.
Once installed, Rapuncel collects stored passwords from browsers, including those protected by app-bound encryption — it does this by injecting code that impersonates the browser itself. The malware also targets crypto wallets, Discord and Steam logins, Telegram session data, Windows credentials, and any documents containing keywords like password, seed, wallet, or recovery.
At least 40 companies have been targeted by name impersonation in the fake repository scheme. LastPass noted that the malware exploits four layers of trust: GitHub as a distribution channel, Microsoft's signature validation, a clean VirusTotal report, and the assumption that official blocklists identify malicious drivers.
The malware persists as a Windows service that starts at boot, and its kernel driver can only be removed through safe mode or external recovery tools. Security researchers have linked Rapuncel to the BrokeyGrab campaign previously documented by Trend Micro, with indicators suggesting Russian origins.
