CTI · reviewed · 2026-09-20

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer with EDR-killing kernel driver

Full story & timeline

Actors

—

Malware / tools

RapuncelAlinubx.sys (EDR killer)

Campaigns

Fake LastPass GitHub repos

CVEs

—

Victim sectors

technologyindividual

Geography

—

MITRE ATT&CK

T1195 Supply Chain Compromise Initial Access
T1574 Hijack Execution Flow Stealth
T1073 DLL Side-Loading Stealth
T1562 Impair Defenses Stealth
T1003 OS Credential Dumping Credential Access

Indicators

No curated indicators tied to this case.

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

Source on GitHub