Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer
Fake LastPass installers deliver kernel-level EDR killer and 'Rapuncel' stealer malware.
Run Microsoft?
Get an email when a reviewed story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Attackers are impersonating at least 40 companies, including LastPass, to distribute a kernel driver that disables 145 security products. This campaign, active for months, uses SEO-optimized GitHub pages and Cloudflare to lure victims into downloading a fake installer that loads the 'Rapuncel' infostealer. The malware then steals credentials from browsers, crypto wallets, and messaging apps, while also profiling the system.
The lesson from this incident
Full lessonAttackers are exploiting user trust in well-known brands like LastPass by creating convincing fake download pages optimized for search engine visibility, tricking users into installing malicious software. The campaign deploys a kernel-level driver capable of disabling 145 security products — including EDR solutions — effectively blinding defenses before deploying the 'Rapuncel' infostealer. This matters because once kernel-level access is achieved, traditional endpoint protections are neutralized, leaving credentials, crypto wallets, and sensitive communications fully exposed. The use of legitimate platforms like GitHub and Cloudflare adds credibility to the deception, making it harder for both users and automated filters to detect the threat.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- malware — Rapuncel
- malware — BoryptGrab
- malware — Cruciferra