Fake LastPass Authenticator GitHub Repos Distribute New Rapuncel Infostealer

Security researchers have identified an ongoing campaign in which threat actors create SEO-optimized GitHub repositories that impersonate legitimate software products, including LastPass Authenticator. These repositories are designed to rank highly in search engine results for users seeking legitimate downloads. Upon interaction, the repositories host or link to a malicious installer that deploys Rapuncel, a new information stealer. The malware is designed to exfiltrate stored credentials, browser data, and other sensitive information from the victim's machine. The campaign leverages social engineering techniques, relying on users trusting familiar brand names found through search results. BleepingComputer reported on the campaign, noting that no official LastPass repositories are involved and that the fake pages are designed to deceive users into executing the payload. The operation highlights the continued abuse of code-hosting platforms and search manipulation for malware distribution.