Fake LastPass Installers Pushed Kernel Driver That Killed 145 Security Tools

LastPass detailed a campaign using fake LastPass Authenticator installers promoted via SEO-optimized GitHub pages. The Rapuncel stealer installed a kernel driver disguised as an Nvidia component, terminated 145 security products and harvested passwords from 25 browsers and data from 30 crypto wallets.

• Attackers impersonated at least 40 organizations; no LastPass systems were compromised
• The driver posed as an Nvidia component and killed 145 AV and EDR tools
• Rapuncel stole credentials from 25 browsers and files from 30 crypto wallets
• The redirect server was still active as of September 10