Fake Software Installers Deploy EDR-Killing Malware and Credential Stealer

Attackers are exploiting user trust in well-known brands like LastPass by creating convincing fake download pages optimized for search engine visibility, tricking users into installing malicious software. The campaign deploys a kernel-level driver capable of disabling 145 security products — including EDR solutions — effectively blinding defenses before deploying the 'Rapuncel' infostealer. This matters because once kernel-level access is achieved, traditional endpoint protections are neutralized, leaving credentials, crypto wallets, and sensitive communications fully exposed. The use of legitimate platforms like GitHub and Cloudflare adds credibility to the deception, making it harder for both users and automated filters to detect the threat.

Tactical Insight

Immediate actions

Always download software exclusively from official vendor websites or verified app stores, never from search engine ads or third-party GitHub pages.
Verify the cryptographic hash or digital signature of any installer before executing it.
Audit and restrict which kernel-level drivers are permitted to load using application allowlisting or Windows Defender Application Control (WDAC).

Long-term improvements

Enforce a software procurement policy that requires IT-approved sources for all installations, removing local admin rights from standard users.
Deploy a vulnerability management program that tracks and alerts on unauthorized or newly installed kernel drivers across endpoints.
Implement DNS filtering and web proxy controls to block SEO-poisoned and newly registered malicious domains.

Detection measures

Monitor for suspicious driver load events (Event ID 7045) and alert on any driver not present in an approved baseline inventory.
Enable tamper protection on all EDR/AV solutions to prevent kernel-level disabling attacks.
Establish behavioral monitoring rules to detect mass credential access patterns across browsers, crypto wallets, and messaging applications.

Framework References

CIS Control 2 – Inventory and Control of Software AssetsCIS Control 10 – Malware DefensesCIS Control 13 – Network Monitoring and DefenseNIST SP 800-53 CM-7 – Least FunctionalityNIST SP 800-53 SI-3 – Malicious Code ProtectionNIST SP 800-53 AC-6 – Least PrivilegeNIST CSF DE.CM-4 – Malicious Code DetectionMITRE ATT&CK T1553 – Subvert Trust ControlsMITRE ATT&CK T1068 – Exploitation for Privilege EscalationMITRE ATT&CK T1555 – Credentials from Password StoresGDPR Article 32 – Security of Processing (credential theft impact)

Source

ThreatNoir coverageFake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer Read originalFake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer

PublishedSep 21, 2026