Affected Systems
Users searching for LastPass Authenticator and other popular software via search engines. Threat actors leverage SEO-poisoned fake GitHub repositories to distribute Rapuncel infostealer malware. No specific product vulnerability; social engineering attack vector.
Exploitation Status
Active campaign ongoing. Rapuncel is a previously undocumented infostealer being actively distributed through SEO-poisoned fake repositories impersonating legitimate software vendors including LastPass.
Business Impact
Users downloading software from compromised search results risk credential theft, session token compromise, and data exfiltration. Particularly dangerous for organizations using LastPass or other impersonated software, as attackers target users actively seeking authentication tools. May lead to account takeover, lateral movement, and data breaches if corporate credentials are stolen.
Urgency
🟠Within 24 hours
Recommended Actions
- Alert users to download LastPass Authenticator and similar tools only from official vendor websites or verified app stores, never from GitHub search results
- Block known malicious GitHub repository URLs at web proxy/firewall and monitor for connections to fake repositories impersonating corporate-approved software
- Deploy EDR rules to detect Rapuncel infostealer behavior patterns and indicators of compromise shared by threat intelligence sources
- Review recent downloads of authentication software from endpoints and investigate any installations from non-official sources
- Implement browser security extensions or DNS filtering to warn users about newly registered domains and SEO-poisoned results