Fake GitHub Repositories Are Spreading Rapuncel Malware Through Google Search

A GitHub URL near the top of a Google search is not proof that the repository is legitimate. Security researchers have uncovered an ongoing campaign that is using SEO-optimized fake GitHub repositories to impersonate at least 40 software companies and distribute a previously undocumented information stealer called Rapuncel.

“On August 13, 2026, the LastPass TIME Team identified a fraudulent GitHub organization impersonating LastPass Authenticator which redirected visitors to attacker-controlled infrastructure which ultimately served the installer,” LastPass says.

The joint analysis with Delphos revealed a larger operation targeting dozens of other companies. The important part of the attack happens before the malware reaches a victim’s computer.

How The Fake Repo Works

The attackers create GitHub organizations and repositories designed to appear in searches for software downloads. The LastPass lure was one example of a larger kit that researchers found impersonating at least 40 companies across security software, developer tools, financial and cryptocurrency services, and macOS utilities.

“The page shows fabricated trust signals (i.e., ‘Authorized Access,’ ‘VirusTotal Approved,’ and ‘Secure Archive’ badges) along with a spinning animation that says ‘Validating session / Generating secure token.’ None of these are real.” LastPass says the badges existed solely to create confidence while the page prepared the download.

The resulting ZIP archive can be unusually large, with samples observed at up to 148MB. Researchers say the excess size is deliberate because some automated security scanners impose file-size limits.

“The victim runs what looks like a LastPass installer; however, it is actually Microsoft’s own debugging tool (vsdbg.exe) renamed.” LastPass explains that the renamed executable loads a companion vsdbg.dll from the same folder, which contains the attacker’s code.

Driver Disables Security Tools

The driver is signed through Microsoft’s Windows Hardware Compatibility Publisher chain and, at the time of the researchers’ investigation, was not present on Microsoft’s vulnerable-driver blocklist. In the campaign, it is disguised as an NVIDIA component and registered as the NvFsFilter service.

“It carries a list of 145 named antivirus and endpoint security products. It terminates every one of them that is running.” LastPass says the driver operates at kernel level, allowing it to kill security processes from below the level where conventional security software operates.

“Microsoft attestation proves a driver passed through a trust pipeline. It does not prove the driver is safe,” Delphos Labs and LastPass write. Microsoft’s own documentation says kernel-mode drivers must meet Microsoft’s signing requirements, while its vulnerable-driver blocklist is intended to block drivers known to have vulnerabilities, malicious behavior or security-model bypasses.

What Rapuncel Steals

Once security software has been disabled, Rapuncel begins collecting information from the infected Windows machine.

LastPass and Delphos found the malware targeting credentials stored in more than 25 browsers, data from about 30 cryptocurrency wallets, Discord, Steam and Telegram session credentials, Windows Credential Manager contents and screenshots. It can also search for documents with names containing terms such as “password,” “seed,” “wallet” or “recovery.”

Researchers also found a browser helper designed to bypass app-bound encryption protections in Chrome and Edge. The malware injects the helper into the browser process and uses the browser’s own elevation service to request decryption, allowing it to reach protected credential data.

The malware persists through a Windows service, meaning a security product that restarts can be targeted again before the stealer runs.

How To Stay Safe

The simplest defense is to reverse the way you normally search for software. Start at the vendor’s official website and follow its download link instead of choosing the first GitHub result that appears in Google.

If you do use GitHub, check the organization’s history, ownership, links and relationship to the software maker. Treat repository badges such as “VirusTotal Approved” as claims made by the page, not proof from VirusTotal. Never disable antivirus or endpoint protection because an installer tells you to.

And if you already ran an installer from one of these fake repositories, assume credentials and session data on that machine may have been exposed. LastPass recommends treating the affected credentials as compromised and rotating them.