Rapuncel puts your defenses to sleep

Article by Nacata Security, 22/09/2026

Did you know a fake installer can silence your entire antivirus in one shot?

That’s exactly what Rapuncel does, discovered in August.

A group of attackers impersonated at least 40 organizations to distribute malware capable of disabling 145 security tools before stealing your passwords.

And they did it with a seemingly harmless trap: a fake LastPass Authenticator installer that appeared among the top search results on GitHub.

The trap started with a simple internet search.

The attackers optimized their GitHub page with SEO to appear among the top results when searching for LastPass Authenticator. There was even a fake version for macOS. From there, the victim was redirected through a hidden chain of GitHub pages and a Cloudflare-protected server, whose destination could be changed dynamically. The server was still active on September 10.

What was downloaded was not what it appeared to be.

The file contained a fake installer that loaded a malicious DLL with the attacker’s code. Rapuncel obtained maximum privileges using native Windows functions and installed a kernel driver disguised as an NVIDIA graphics component, designed to terminate 145 antivirus and endpoint security products. The driver also contained code to hide itself and inject into active processes, although that function was never activated.

With defenses down, the theft began relentlessly and automatically.

Rapuncel searched for passwords across 25 browsers, files from 30 cryptocurrency wallets, Discord, Steam and Telegram tokens, and Windows Credential Store credentials. It also captured screenshots from every monitor and a detailed system profile. The malware launched on every reboot and repeated the cycle without stopping.

Without the driver removed, nothing stays clean.

According to LastPass, the machine can remain completely under the attacker’s control until the kernel driver is physically removed. Rebooting or restoring the antivirus is not enough: the malware detects it, kills it again, and re-executes the theft.

The campaign reveals an organized criminal network.

The investigation, conducted with Delphos, revealed that the malicious DLL was likely generated with PUROSANGUE, a package from the Cruciferra crypter service, recently documented by Proofpoint. Cruciferra had already been used to create DLLs with code to kill EDR and antivirus solutions. This places Rapuncel within an organized criminal ecosystem, with reusable tools and well-established malware supply chains among different threat actors.

Rapuncel and BoryptGrab share too many traits to be a coincidence.

Delphos compared the Rapuncel payload with BoryptGrab samples documented by Trend Micro. Although they are not byte-for-byte identical, the behavioral and artifact overlap is very strong. The conclusion is that Rapuncel is a variant or sibling build of BoryptGrab, distributed across approximately 100 GitHub repositories earlier this year.

The attackers impersonated at least 40 real brands to gain credibility.

This is not an isolated opportunistic attack: the campaign has been active for several months, with confirmed active maintenance between August and September. LastPass’s internal systems were not compromised, but its brand was used as the primary lure to attract victims.

The infrastructure was still alive and operational.

The central server was still active on September 10, serving a JavaScript redirect. LastPass confirmed that its content had changed between August 27 and that date, demonstrating active maintenance. This was not a one-shot attack, but an operation with continuous management and real-time adaptation.

A live operation, not an attack from the past.

As you read this, the infrastructure could still be active in another form. Do you know exactly what you installed the last time you searched for an app on GitHub?

Would you check the origin of every app you have installed today?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime