Loading story…
An ongoing campaign uses SEO-optimized GitHub repositories impersonating LastPass Authenticator and at least 39 other brands to distribute the previously undocumented Rapuncel infostealer. Victims are routed through counterfeit download pages, GitHub Pages trust signals, and manipulated 404 redirects to oversized ZIP archives containing a renamed Microsoft Visual Studio CoreCLR Debugger binary that sideloads a malicious DLL.
Rapuncel deploys Alinubx.sys, a Microsoft-signed kernel driver disguised as an NVIDIA component, to terminate up to 145 antivirus and EDR products, including Protected Process Light-protected tools. It steals browser credentials, cryptocurrency-wallet data, Windows Credential Manager contents, messaging and gaming sessions, screenshots, targeted documents, and host information before exfiltrating data to 2.26.126[.]50. Researchers assess it as a likely BoryptGrab variant delivered with the Cruciferra PUROSANGUE crypter; technical indicators also suggest a possible Russian origin.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Researchers reported that Rapuncel steals credentials from more than 25 browsers, wallet and messaging or gaming-session data, Windows Credential Manager contents, documents, screenshots, and host information. It injects into Chrome or Edge to invoke the browsers' Elevation Service DecryptData capability, then uploads collected ZIP archives to 2.26.126.50 via HTTP-formatted raw TCP traffic.
LastPass and Delphos Labs assessed with moderate confidence that Rapuncel is a BoryptGrab variant, an assessment also supported by Arctic Wolf. Researchers also found that Rapuncel's loader was built with the Cruciferra PUROSANGUE crypter.
The malicious ZIP payload used a renamed Microsoft Visual Studio CoreCLR Debugger executable to sideload a DLL and install Rapuncel alongside Alinubx.sys, disguised as an NVIDIA component. The Microsoft Hardware Compatibility Publisher-signed driver can terminate 145 antivirus and EDR products, including protected processes; it was not on Microsoft's vulnerable-driver blocklist at the time of reporting.
LastPass and Delphos Labs uncovered an ongoing SEO-poisoning campaign using GitHub repositories impersonating LastPass and at least 39 other companies to distribute the previously undocumented Rapuncel information stealer. The repositories redirected victims through fake GitHub Pages trust prompts and modified 404 pages to oversized malicious ZIP downloads.
LastPass and Delphos Labs reported the Alinubx.sys driver to Microsoft and were directed to the Windows Defender Security Intelligence portal for driver submissions. Microsoft said the issue was not a vulnerability in a Microsoft component because the abused driver was not a Microsoft component.
Trend Micro documented a similar campaign called BoryptGrab that used ZIP archives referencing popular PC games. Its analysis found comments, log messages, and IP addresses suggesting a possible Russian origin.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcebleepingcomputer.com
Open sourceblog.lastpass.com
Open sourceloldrivers.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components. The repositories deliver a multi-stage **LuaJIT** loader chain that ultimately installs the **StealC** information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, `base64url`, and **AES-ECB** before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through **Polygon Mainnet** smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender `Gen:Heur.FakeGit.1` and ESET’s `Lua/Agent` family, while infrastructure usage heavily overlapped with bulletproof hosting providers including **ASN 207957 (Serv.host Group Ltd)**.
Jul 22, 2026
An unattributed threat actor has run a large malicious GitHub campaign using at least **292 brand-impersonation repositories and pages** to distribute a **BoryptGrab-lineage infostealer**. The operation used deceptive GitHub profiles and `.github` repositories that mimicked legitimate software companies and trusted security vendors, including a fake **Arctic Wolf** GitHub presence, to make the content appear credible to developers and IT users. The repositories reportedly used marketing-style `README` files to look legitimate while concealing download links that redirected victims to malicious payloads. Researchers said the activity had been active since **26 June 2026**, indicating a broad social-engineering effort that abused GitHub's trust model to lure users seeking software, tools, or vendor resources into downloading credential-stealing malware.
Jul 17, 2026
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026